hxxps://storage[.]googleapis[.]com/cac-corr-prod/704362/2026/07/05/399b5cc4-8397-4801-bb63-a0cb439ba8d9-704362/HD%20INC_20260707085303976[.]zip?X-Goog-Algorithm=GOOG4-RSA-SHA256&X-Goog-Credential=vault-auth-sa-gke%40highradius-prod-cloud13[.]iam[.]gserviceaccount[.]com%2F20260707%2Fauto%2Fstorage%2Fgoog4_request&X-Goog-Date=20260707T135304Z&X-Goog-Expires=604800&X-Goog-SignedHeaders=host&X-Goog-Signature=6156a43ad8b44da4bce07053ec5a04f8ddf9a03e3b26cec410e5168c152741d296d9607637452777aee14f0f829c192fbb97d6e66ff87ab9c35ceeaaef25e3d91cb39e4d2d63ef14256dc48277ea7c36b0caa09618b1a3e145e7c04e72bcf7d52f5c80eb757dd92f1b48ff0a2d781d7826aa0a811f51405843d368621520983d63cc44175f23212b95a0e9acbd9ebbfba3a3aebe28676c89af19a7d87797ce817077e2fa34a693adf4d849f7878e4539358ef49e1db79999202ed44126b2fa713a4d8a0073d63c3daa459a9f8ae881dc50786a429e0f83dfc41b0597fb4c6e4089065057266b372574f6259771ab07e4cafe4025c214d6d26b815fa6bb0b669b

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://storage.googleapis.com/cac-corr-prod/704362/2026/07/05/399b5cc4-8397-4801-bb63-a0cb439ba8d9-704362/HD%20INC_20260707085303976.zip?X-Goog-Algorithm=GOOG4-RSA-SHA256&X-Goog-Credential=vault-auth-sa-gke%40highradius-prod-cloud13.iam.gserviceaccount.com%2F20260707%2Fauto%2Fstorage%2Fgoog4_request&X-Goog-Date=20260707T135304Z&X-Goog-Expires=604800&X-Goog-SignedHeaders=host&X-Goog-Signature=6156a43ad8b44da4bce07053ec5a04f8ddf9a03e3b26cec410e5168c152741d296d9607637452777aee14f0f829c192fbb97d6e66ff87ab9c35ceeaaef25e3d91cb39e4d2d63ef14256dc48277ea7c36b0caa09618b1a3e145e7c04e72bcf7d52f5c80eb757dd92f1b48ff0a2d781d7826aa0a811f51405843d368621520983d63cc44175f23212b95a0e9acbd9ebbfba3a3aebe28676c89af19a7d87797ce817077e2fa34a693adf4d849f7878e4539358ef49e1db79999202ed44126b2fa713a4d8a0073d63c3daa459a9f8ae881dc50786a429e0f83dfc41b0597fb4c6e4089065057266b372574f6259771ab07e4cafe4025c214d6d26b815fa6bb0b669b
Sample260804-tp1wbsde47

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3472	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303337121377337"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{1770E9A1-0296-401C-A7A0-C2917ADC00DE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 4448	4164	msedge.exe	84
PID 4164 wrote to memory of 3472	4164	msedge.exe	85
PID 4164 wrote to memory of 2132	4164	msedge.exe	86
PID 4164 wrote to memory of 4384	4164	msedge.exe	87
PID 4164 wrote to memory of 2132	4164	msedge.exe	86
PID 4164 wrote to memory of 4384	4164	msedge.exe	87
PID 4164 wrote to memory of 4384	4164	msedge.exe	87
PID 4164 wrote to memory of 5004	4164	msedge.exe	89
PID 4164 wrote to memory of 1416	4164	msedge.exe	90
PID 4164 wrote to memory of 5004	4164	msedge.exe	89
PID 4164 wrote to memory of 5004	4164	msedge.exe	89
PID 4164 wrote to memory of 1416	4164	msedge.exe	90
PID 4164 wrote to memory of 1416	4164	msedge.exe	90
PID 4164 wrote to memory of 3856	4164	msedge.exe	91
PID 4164 wrote to memory of 3856	4164	msedge.exe	91
PID 4164 wrote to memory of 3856	4164	msedge.exe	91
PID 4164 wrote to memory of 5076	4164	msedge.exe	92
PID 4164 wrote to memory of 5076	4164	msedge.exe	92
PID 4164 wrote to memory of 5076	4164	msedge.exe	92
PID 4164 wrote to memory of 2356	4164	msedge.exe	96
PID 4164 wrote to memory of 4540	4164	msedge.exe	97
PID 4164 wrote to memory of 2356	4164	msedge.exe	96
PID 4164 wrote to memory of 4540	4164	msedge.exe	97
PID 4164 wrote to memory of 3400	4164	msedge.exe	99
PID 4164 wrote to memory of 2788	4164	msedge.exe	104
PID 4164 wrote to memory of 2496	4164	msedge.exe	105
PID 4164 wrote to memory of 540	4164	msedge.exe	106
PID 4164 wrote to memory of 1972	4164	msedge.exe	114
PID 4164 wrote to memory of 1972	4164	msedge.exe	114
PID 4164 wrote to memory of 4504	4164	msedge.exe	116
PID 4164 wrote to memory of 4504	4164	msedge.exe	116
PID 4164 wrote to memory of 4932	4164	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://storage.googleapis.com/cac-corr-prod/704362/2026/07/05/399b5cc4-8397-4801-bb63-a0cb439ba8d9-704362/HD%20INC_20260707085303976.zip?X-Goog-Algorithm=GOOG4-RSA-SHA256&X-Goog-Credential=vault-auth-sa-gke%40highradius-prod-cloud13.iam.gserviceaccount.com%2F20260707%2Fauto%2Fstorage%2Fgoog4_request&X-Goog-Date=20260707T135304Z&X-Goog-Expires=604800&X-Goog-SignedHeaders=host&X-Goog-Signature=6156a43ad8b44da4bce07053ec5a04f8ddf9a03e3b26cec410e5168c152741d296d9607637452777aee14f0f829c192fbb97d6e66ff87ab9c35ceeaaef25e3d91cb39e4d2d63ef14256dc48277ea7c36b0caa09618b1a3e145e7c04e72bcf7d52f5c80eb757dd92f1b48ff0a2d781d7826aa0a811f51405843d368621520983d63cc44175f23212b95a0e9acbd9ebbfba3a3aebe28676c89af19a7d87797ce817077e2fa34a693adf4d849f7878e4539358ef49e1db79999202ed44126b2fa713a4d8a0073d63c3daa459a9f8ae881dc50786a429e0f83dfc41b0597fb4c6e4089065057266b372574f6259771ab07e4cafe4025c214d6d26b815fa6bb0b669b
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb8057c188,0x7ffb8057c194,0x7ffb8057c1a0
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,6527130173702261304,2384511322337883476,524288 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,1732369912194733533,13212294813015430233,524288 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,13866513930063134814,7403929469581492685,262144 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,515032681357710428,1009378522067585626,2097152 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,17321747977903837951,3366988022500786202,2097152 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,16097041406442883483,16763882628724830594,2097152 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,8349223856999175047,5591183284495444236,2097152 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,14499750303412554877,15982567931400718507,524288 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,7259982388058809219,5963269411522367511,524288 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,13859950800942743905,17839229628931066724,524288 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,13859950800942743905,17839229628931066724,524288 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,2875640951947259998,18328561038590426258,524288 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,15170235159618670100,2699255591715718363,524288 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,554342973899911171,8916702294281867438,524288 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,5513790687444166741,14864864468316069524,524288 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,3488500806433590787,10645469628635471872,524288 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5792,i,10519166217658113100,11647618755503421251,262144 --field-trial-handle=2472,i,8967236292132447846,12829473984394376967,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0306d7eb1b939469fe4ebf121f343072c2877eb6e85e6066ab79d2d065b9f116
MD5 6113bc6e8a008d3777f36e8a3cc177bd
SHA1 739a22d03160cba69ce4f02c49a9a89d0a0b1e16
SHA512 c9bdd2eb15da92372fe41e7f9a3fb8ec6aff8695102e0e94641513515dea945ff83ec18e9e59397c04b3590f1aaf2295de7498d125be8a588dde23ebc43961bd
TLSH
T1CC615D8545E23558F3703371E3D2220434B0C6DA4C038C7255846ABED6E9BB5BE5EE48
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 812e94014b5b97f2a8b5d83cc5acce4e059180b277cdc9ef9b1308ed9d1c13a1
MD5 b46c70648541db8635d710444611b604
SHA1 20729fa9cde8e3c3d9f87ca62406636d088918fd
SHA512 f0e84feda5c32af3c8cab123fe196852b28af675ce66d6e65079074bcf39ed0616773d405ddb40fa8b09551890898c254b1d93c1d47ac73d8c846b9d83f652c6
TLSH
T14231CCE3CBD9CA6EC9014AF09A14BE17CE2D0A10421C3C5989D4FF6B93E2071D11256F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9cb01f7c826c09956f42393a7e51c967c37ce018ba5e4d9ef4f191588cc2c0c2
MD5 bad2673ea01e3bf67083a4776b8b24f4
SHA1 88e50d2d79c92bf5720bb10ead842b04699b407b
SHA512 7584ae760c81df39216d6467afe634871a9d55ac0fac29e0a61fcb5658e69cd0e9a4b8fb97a79fe564eb83881d4f2b729a39e7db76d4bbc8757cc930c1e4b274
SSDEEP 192:sxZMRYyM/jK1Ml8Mkw/fzsm/gkIdp/LHW6+WN5CMq/YLNKHPQedIgrJ:sxZMqMw/fzsm/g9jHb5w/7oeB9
TLSH
T114521A52AB346977CCDBD209FA45BF93D6F51472A2540E48A9FCD91C04E2BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5cbdcbfa8876e97e212b75bc5fbce1edb64c29b719c4061bbf26362ee2114361
MD5 590ba485c6078b54aeb2cda608213cbd
SHA1 4349ef2ba56e53cad6dda9b13c70b1c057252c68
SHA512 e798349831a67721ef7e603617c9d1a9b7f50411b47cca2a188a761576cc9437dadf173909a72c679bb619404e7593f6b13aba20b353ae735e0072e5031ecb7e
SSDEEP 192:sxZMRYyM/jK1Ml8UQLkw/fzs0/gkIdpFLHW6+WN5CMq/YL35HmQedIg51J:sxZMqqgw/fzs0/g9hHb5w/cjeBF
TLSH
T134520952AA345977CCDBD209F981BF93D6F5147292540E48A9FCDA1C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8c803b8ac4565a8e98288a37a3d7ea893da8d581cadb7e8863dab4be00606174
MD5 e6d627c93c28082dffe064637a05224f
SHA1 45d82a212cace274d0e2a9927093efa15ae550f2
SHA512 7fc8d7ae161862ba3aa7491728159c590163d2c1aee50c4f0e9119a43d1cc80290afbd52d0ef2b12d08e6d123e7b4a77d47c8071d3ea041eac1cb2f2010372a2
SSDEEP 768:zrs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN0rof9:zrs6pD1WvxzWju1jahILIsNff9
TLSH
T17DD2FA3B680CCB7E4F840E5CEC6A6E977DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 905c8f2f4e05835a41c3dc04bb01591e9301dcb1a038f22f01d60b86d7681e52
MD5 f68a4b7012a606d495ebcd78a43a9ea1
SHA1 b5625ca799e77c91fbdaac52572f1b73cb519f78
SHA512 be9d466721226a254b44f8300071d2f57c258fb233d81a97050611fd63e9287220cd0044122de1dcc060fc0556b65da791502254d1bca5b3baaf46f10de94fab
SSDEEP 96:KUAAKtePCcAKp26OhOKiApKIKbq66aMKrKf:ii7r9tX3M
TLSH
T1B5E1141232BB47522C7E790DA35487674B42F6633018E82B7BA920B11E67E744DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6d937344ebe783c4cd29b2d80a23c5c8650ea50ebf23159de273c84a1d527cdd
MD5 7a3475efcf431fd1343f6a8712fe4460
SHA1 90956917666ca894d639c8c43e1e712fea004cb4
SHA512 3233c53f5ad28be6eed8dfb9a0aae96db4b5e783cd31ddc8bacbb61468c440947a57f66be88926fac9b6f4a4014191a26fafb4a2e73f6387bc3100d28b1d0f5c
SSDEEP 384:FZcIhsNZ9bjD0/bBa9DO5MzYzJr3TO4LBeRs9JKgqijUMUQb:9heiUhOs8hDOUTjKgqmU0
TLSH
T1A0928C7198289D7699F2F581F98A3A134FF48027DAC56F94D1ECAF0C019B99C130A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7afbb7f75dd8793aac0158409ea3dacb9279706155fcfc7fb952533a7da7b431
MD5 6de7c0841dd47da22f01a34c22298a4e
SHA1 7a5c05bfda29d3097cf7691127326c1fefd1ecc6
SHA512 ea0a6ed4040edd64a6abc917d908dde4d044eb04170277466796632f16256feeb068eb4c12ee14c19ffd97a3087ac0127cf97299d4a85564f81e3f0cb09af346
SSDEEP 384:OqZcI3zsNZwbjD0/8Ba9DO5MzYzJr3GO4LBeRs9JKgqijUMUQb:5jjNUhOs8h2OUTjKgqmU0
TLSH
T10FC24BF054E75872D9AEA743A7BE2E034EBCC027B6805E54B3D86A0CCC9657FD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6ebce97acf54687ded843322aef0b5380765aa51fffcaea99dd19de21ca22fe9
MD5 80b8df53355f828b4dcdc3133c551e55
SHA1 1eda3218c36a19bf1d104c57859d9d1c80122fdd
SHA512 4179cd4a24ddb24e9d798fb6b88e7fe0801ef4f4e39b806bf6de4d186a11a1e873d3151d3eac09e09f2103d930aaccf549688ae755a023ed1c857683f9d1a7da
SSDEEP 192:qONx6O7+3hQmiUynZGttb0CO2b6h2SUgGQZU6:qONx61mGt9DO5MSaUU6
TLSH
T16902E93468686CB74EF2AE46BA873B235FA5103BE9952F84D6EC1F1C00D765C2346827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1156033738048019caa41a1b84357003f475eb4b7d869de57ad426f2468b11a4
MD5 bf49b627ae432adc80af2297b73eec27
SHA1 aa3effb58ffc8ac95a0f339b0c652a4af842d335
SHA512 33e987b10c24274eb3e4040bd887f5f828c75c7d60d4f1c65251c4f9b5bf2b74b0d57f5b8d37f356fc88732808bccc5c9cffcbaab4c53d0cbf6b1c2643acde08
SSDEEP 384:qZcIhsNZwbjD0/bBa9DO5MzYzJr3TO4LBeRs9JKgqijUMUQb:IhjiUhOs8hDOUTjKgqmU0
TLSH
T114928D7198289D7799F2F581F9863A178FF48027DAC56F94D1ECAF0C01DB99C130A91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e53a4a9003c6e59c57c159a71476c364bcb8fbee47ee53e8fd78626185a88dec
MD5 45179e29aee4003dba583671b190bb71
SHA1 bb42b5736730cd7b9b57b591f246df1b85054f2e
SHA512 eee975937c5792e88e32ab5048e504f1f311f1d0f8ed3be24f431c0f7c159b1635587535768e448b16a0b273c70ac7b12f47f89b71287b24ed16ea3c584f7506
SSDEEP 192:CONU6O7+3SQmiUyTZzttb0CO2b6h2zcF0SJr3LcNZqI24LU6:CONU6oAzt9DO5MzYzJr3wO4LU6
TLSH
T10E121B356868ACB75DE2A541F9C735138EA50127DE8A6F80D1DC2E1C01EFA6C234AC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c413f6a1b91d8b3c0c7646123eb0d426e1fb05bb69270787ac6ef1e1abcbcf71
MD5 ece5a377f8cfad0bfedff89bed1c04d1
SHA1 6756ba7e795d73108543a8b2f2dbdd7974f51c74
SHA512 b530e03cb0cb54a5f1bf6832ce23f025e8d67bd3bac649c588a9bd2b1d4c206eb91fe748178c83f74eb752862ed81ec344849eabfbf1c018a94558d421028869
TLSH
T1B7412958BAF91144B3B7BE56AFF7A86D487EBC772F06905E00010D4F0A66A40D8B2737
MD5 SHA1 SHA512 TLSH

Submit Download