7cdc762c7162cf821a90e45fe081aa38c0139499c4223c648973a3cb83299bd3

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wsdashdbasdjwqjkherjhkqawzkjenmasdkxhn.github.html
Size 1KB
Sample260804-ajrwpaaa45
SHA256 7cdc762c7162cf821a90e45fe081aa38c0139499c4223c648973a3cb83299bd3
MD5 8c3e147b26507039ea9b2b54a003a872
SHA1 55d57d1b6637ca334592139bf2f6674f0d02b099
SHA512 2bf3b8c938e990e1041dfeb207ab02cf0df437e0986db8ca3f56f59b54f706ab3370d4aa775c41e2fc5dbb441a0c84e24c8307fb8eed929a98a937f704ca22ad
TLSH
T1A221265F4C7764168ABA20841F7B71445026440F7781C4CCB79FE9489F99A41CCD36EF
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
28	3544	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
25	raw.githubusercontent.com
26	raw.githubusercontent.com
28	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3544	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302764483036309"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{C3F4244A-AF4E-48F0-BD85-5FFE561809F1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 60	4808	msedge.exe	86
PID 4808 wrote to memory of 3544	4808	msedge.exe	87
PID 4808 wrote to memory of 2152	4808	msedge.exe	88
PID 4808 wrote to memory of 2152	4808	msedge.exe	88
PID 4808 wrote to memory of 2152	4808	msedge.exe	88
PID 4808 wrote to memory of 3188	4808	msedge.exe	89
PID 4808 wrote to memory of 3188	4808	msedge.exe	89
PID 4808 wrote to memory of 3640	4808	msedge.exe	90
PID 4808 wrote to memory of 896	4808	msedge.exe	91
PID 4808 wrote to memory of 3640	4808	msedge.exe	90
PID 4808 wrote to memory of 3640	4808	msedge.exe	90
PID 4808 wrote to memory of 896	4808	msedge.exe	91
PID 4808 wrote to memory of 896	4808	msedge.exe	91
PID 4808 wrote to memory of 4920	4808	msedge.exe	92
PID 4808 wrote to memory of 4920	4808	msedge.exe	92
PID 4808 wrote to memory of 4920	4808	msedge.exe	92
PID 4808 wrote to memory of 4432	4808	msedge.exe	93
PID 4808 wrote to memory of 4432	4808	msedge.exe	93
PID 4808 wrote to memory of 4432	4808	msedge.exe	93
PID 4808 wrote to memory of 2704	4808	msedge.exe	97
PID 4808 wrote to memory of 2704	4808	msedge.exe	97
PID 4808 wrote to memory of 3592	4808	msedge.exe	98
PID 4808 wrote to memory of 3592	4808	msedge.exe	98
PID 4808 wrote to memory of 3592	4808	msedge.exe	98
PID 4808 wrote to memory of 3988	4808	msedge.exe	99
PID 4808 wrote to memory of 2472	4808	msedge.exe	100
PID 4808 wrote to memory of 2472	4808	msedge.exe	100
PID 4808 wrote to memory of 3724	4808	msedge.exe	101
PID 4808 wrote to memory of 3724	4808	msedge.exe	101
PID 4808 wrote to memory of 432	4808	msedge.exe	102
PID 4808 wrote to memory of 432	4808	msedge.exe	102
PID 4808 wrote to memory of 3432	4808	msedge.exe	105
PID 4808 wrote to memory of 3684	4808	msedge.exe	110
PID 4808 wrote to memory of 1252	4808	msedge.exe	111
PID 4808 wrote to memory of 4852	4808	msedge.exe	112
PID 4808 wrote to memory of 2512	4808	msedge.exe	113
PID 4808 wrote to memory of 2512	4808	msedge.exe	113
PID 4808 wrote to memory of 5024	4808	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\wsdashdbasdjwqjkherjhkqawzkjenmasdkxhn.github.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbfb32c188,0x7ffbfb32c194,0x7ffbfb32c1a0
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,9963272231952380050,1434128213758857560,524288 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,6869400037610702947,557336444382686726,262144 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,15065040256022915195,8735600876057743522,524288 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,14307113050363969954,13265646962855758110,2097152 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,3391662528480226824,13684217929219571843,2097152 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,6089530904772210003,16171547372182875055,2097152 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,12569794530131679090,11009148587703894000,2097152 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,9841127476249223592,11335868163548100624,524288 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5288,i,11479635364632898534,1115404858813431535,2097152 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,14888816889031665396,11377448699337292658,524288 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,2546429677582203090,13446450816563275422,524288 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,4232063949578258644,6691738755087604600,524288 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,1837819683486721553,11245760397136185991,524288 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,8894367828343906092,13603830908223697659,524288 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,8894367828343906092,13603830908223697659,524288 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,16117121515094049576,380666482324010170,524288 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,5488189358775626502,16866839941206194278,524288 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,5501076064926017317,15112639342812539674,524288 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,2718651332514398025,2633712721411991398,524288 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6688,i,2621266845964373471,6167241825326531603,262144 --field-trial-handle=2060,i,12285405545819297681,2530850199911951379,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 910f8fae31ddc5d64014af5f406fb777859c0cf9e78fa345f204173d82a41b43
MD5 6f86a5b56ebbc7aae6bb0d0d9db30967
SHA1 73161fcb1af18a9df34b76830803106114389da4
SHA512 694de80981b424da8b3f6779f9a106da38d7d0def25b677d7b52955d414467bfe3c86764884da999ca2383171d7c118c53da750fe27ab84d7713d3b370b3d15a
TLSH
T1B16192781B721756E366123FE0F0860CBB73C2EEF92B1E3E439028BA650DB944144D07
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590361.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590361.TMP
Size 3KB
SHA256 6dc2912cff2eb57bdb1856b98210e5eb68bf0b20a212880da4e32398d1a2731f
MD5 9965f730bdd2499d92a998b8172138ad
SHA1 6de39da8778c11fa9dfd419126c0e877267e9be9
SHA512 e1b51d07fa9f70d2b852e1565bf3c00b16b81a22de54697743d1bcc72a597fcd088892cd7387330f806815a6f1ae692e89275f4611bf11588a842e2fcad9a4ee
TLSH
T13B6181781B720796E366117BE0F0860CBB73C2EEF82B1E3E4390297A650DB944184D07
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5205186c7928807eecf5ce47a88aead0bf34510b18d34adda4842901d4071f95
MD5 e37b3f7c4fed85174e78d8adf249238b
SHA1 ca681589495ccd512b267f967c468c5510228e6b
SHA512 693fae4569ca09a93c00242bd62ad7b91db87a4c157ff2ac597930e77d2dd7c85818d600d4bd883b5db8fc2f13634c56efe490ea5db2133a7ef2c3c87a4ef5d4
TLSH
T1032191F383E5866E8A1156F05A18AE1BCE2D0506432C7C2589E4FF2B93F3075D10165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1bc2a840a328177210f6c60f1f14f83874187275dd7172f9c5309393e3b8df3b
MD5 f2e459802e92e784cdca34abd0fd59b4
SHA1 ea95465c025fa37fb73e1d804e88f320c82de206
SHA512 a17736b0c347ac48c9b52958ea535651ae2c4c6638d376996bbb278f708cfd472a857623d80f488a2d3f68843e6063cf64f508b18c3973a225cb10a717e49247
SSDEEP 192:sxZfRm9o/fcsT3iKIdpdhHW6+WNGY9IKImNIg5ESJ:sxZf6o/fcsT30DHbGCF
TLSH
T1BC22B7126E38A97B4CCBD209BB297F53E6F9503251D01E58E6FC961C05E7ADD220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a5200e526f4bf0f2bc1e0d07dd1f991967db75b6c253e73beb04f2966dbb870e
MD5 6ba4e6342bc8111015ae05cdc2b3f8d9
SHA1 c403beac907c127c94b5e7fd6d490399885304a7
SHA512 fd9f3ff6da13b608d1211f2fd2995d0a83f261eccd421ff9b2f5f9a492519b73cee22531e82e0009357ed3ce7909e008b79d7ad2cd34f3e77b7527805924251f
SSDEEP 192:sxZfRm9o/fcsV3iKIdpdhHW6+WNGY9IKImNIgrJ:sxZf6o/fcsV30DHbGC9
TLSH
T1FB22A7126E38A97B8CCBD209BB297F53E6F9503251D41E58E6FC961C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 75da158632df0db8c34c166ccc115762a686818f00ae572a94bc3f9e55eda75a
MD5 931622b0c7460d5829c86d554ce87e5d
SHA1 c17d26f9fdd0cd5486afeeb0267497fcecc873d3
SHA512 1dc9b80901eee2e2191338b9656e4cd296a94eebb30ddf5f3c54a24ae86c261953e0829defc9a23ed0cf41f8b23a9cb84ed831d2aaf5b31f6a4819ed628fa411
SSDEEP 192:sxZfRm9o/fcsThiKIdpdhHW6+WNGY9IdcmNIg5E4J:sxZf6o/fcsTh0DHbG1r
TLSH
T1F422C7126E7869778CCBE20DBB297F53E6F9503251901E58A6FC961C05E7ACD220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c473437bf99cae0a86df5190d29e619abca00b02737c5ce9575c4d8773154e35
MD5 da21f1835bcc78734ead7d4ba95f54c3
SHA1 c68ecd26125982ab4229eac7bf031c1c1010c0bc
SHA512 7e573e0df972f08264b54aa3c03297d3aee7679bd81de4cfdce3ab8c847288215b1d7d2cab3de0ab8de0c31fd89d690168f8d12c41cb7cd9a0bfdce37c40b853
SSDEEP 768:QgyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7broKbqu:QgyvIZwWvu+Q+u1jamFLeR7oKP
TLSH
T1B9C2F92B240CCB7E5F801E9D9D5A6F9B3EA802C767988D4047FD994C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1f6382408c148dee7c308b2ca9ead9dcb4457cdba4ce650cc0ac05de7d0884da
MD5 cd0a3ca29080811216fab6c951c97d20
SHA1 0e97478768ad5045856b80e41e65125b956937cd
SHA512 0be3b8d408d260ddbad65b4d768282ecd18ce43a61ad1bf01de49966b38efaa49195ac31db908d672cd7cdf2afae0e9ee65103dcbcee8fefab40468fe04fbaaa
SSDEEP 192:uu3LsNmuQwJCpZh+YLefyQmiU1eOn4e+CGQO9UNR+oJiuq068:psNmujJS7ziGL4e+CxO9+RqgD
TLSH
T1E3423A32AD785C775DE2A584F44B3213DEB850A7D6C42F90D5DC6F1D02DF6AC230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 22e95e887a5d8ced63f1b040f0a1eec256d06f47d30127452e1e88b0f875182a
MD5 cd6da65b260ac20d672959366e628efb
SHA1 80a1ed811a39639ac9dfc275bd377e88d3a4a65a
SHA512 88738004f5639a3a4729ac1bdd9b5d53ba5e3662cd229b16ce68dd26ef4ceb0beab5b7d0e96de915977dc6d49dcc9c86b6343edc766d1614ffc0e812e30af8cc
SSDEEP 192:uhSZm+xasuheOwQxMltzsNm4QwJCpZh+YLefyQmiU1eOn4e+CGQO9UNRToNiuq0+:DqZcIkzsNm4jJS7ziGL4e+CxO9+Rtg+
TLSH
T127826B32AC785D775DF6A944F48B32139EF8A077E2C46F90D1DC6B1D01DA6AC2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 65381058bcf3b6c51657c85a251d2664377f4a66c7100bb7ab7d248c34e5b511
MD5 491514ab152a3a545a61f930f68fb828
SHA1 19b273dc14c4b7c332cf299ab3e1ccfa33c8a48a
SHA512 75991ca0b3ec6890cbbb5bd4a4f27d45a84d817bf26cd5cf4d4997ad5f8cd3a14e5eabbf8b053a2f330a580f8ddf84dca37767a7e2e0a0a15aec1dc7a7067da4
SSDEEP 192:JONk6v+YLNQmiUykwZh+CGQO9UoushLU6:JONk6vz/eZh+CxO9PtU6
TLSH
T17B02E835BD782C7B9EF2AE05F98737179FA8213BE5912F90D9D82E1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 8239b1c20779340b63e3c8e869e72c9a9f088592b98ae3ba069214f1c7d831cd
MD5 f0dc57f47352d4f1847dc265bf04b703
SHA1 f0e72acc7d2f46ff5378e6ac1221750a3da7bbbd
SHA512 192a165755c21f355ced6b513c98bd1fd903601df20b21790dc71c89b5f55ff70f3c09ed3c94abcd3f97383ca94b55e2f8293a547d715ce8f5cd07a6e33c20cc
SSDEEP 192:un3m+xasuheOwQxMGsNm4QwJCpZh+YLefyQmiU1eOn4e+CGQO9UNR+oJiuq06m+b:lZcIhsNm4jJS7ziGL4e+CxO9+Rqg+
TLSH
T1B0727C326D381C775DF6A944F44B32139EF8A077E6C46F90D1DCAB1D01DA6AC2306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 53ccb17f58b662525cabe21df7f0e3cc3d2ac8b278d607b4fc8bc8df432b4659
MD5 8f15a1badf69fb3ce50f69230362bacd
SHA1 fa3da89ba3d2f0a2ddc6ed512b86c576d32402c8
SHA512 0627d690ecbad6b4b56be43224496c8c1f6cb81b3633cef2cc58cc74ce74071efec58ca27adf93fe160b6bc41ada51a61102146931501099c806fcd11e1255e1
SSDEEP 192:YON/6v+YL1QmiUyEwIh+CGQO9UNRtCHuq0U6:YON/6vzHgIh+CxO9+RagU6
TLSH
T131123B32BD785C775EE2A944F48732139EA85167EA853F90D1CC3E1C02DF69C234A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aff70b84-1e1e-41aa-97f8-cddafaf32586.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aff70b84-1e1e-41aa-97f8-cddafaf32586.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a2e8abe10265b534e32c76d2883bc0ab47e7649beb60f1b704d93f438be61fe7
MD5 590c6a6b03285872a500042609d37f1e
SHA1 f8451e17bc5719968ad68ad22e26be222bfa7827
SHA512 7cde08bbc431ae6f623bca9daa282d3d961adcf7ae23c99ab215d14280dbe50865d48caf8b2557c34145f2f68201fb2c379c677a60fe5b752def3baa05e5bf8d
TLSH
T1F5412758A6F91158B3B76F5AABF7A96E487EB8332E06809D10110E4F0A26B01C871733
MD5 SHA1 SHA512 TLSH

Submit Download

bwpaaz.dll

Path C:\Users\Admin\Downloads\bwpaaz.dll
Size 498KB
SHA256 8a8caf0cfb02a65bb02c7df5f2a3d5d88db04de0b364b0c87a540fbac1ff6b0b
MD5 e6a1fb79e061a066c7611fe6635a3ebd
SHA1 c790bb69af520b4b111195ff61655a3250152cf8
SHA512 decacffebbc6ee4c369be4452b56277e6862999818d6d95de4f1334de5d82fe20c22d7bcb1a3545b3300d761f92c61f09b24ad22edc7439d7b1f3f2121175f75
SSDEEP 12288:hFLlmthPKZL0bgmfUjSH8QlnwV8k0nN2Th1:hFLwthSZL0VfUdQlnKnf
TLSH
T113B49D15F3A900B9D167D53CD657AF0BE63138044B11AACB73D1EC682FE27E05ABEA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download