hxxps://static[.]s123-cdn-static[.]com/uploads/4601649/normal_60037ff41b65d[.]pdf

Analysis

user interaction
yes
max time kernel
36s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://static.s123-cdn-static.com/uploads/4601649/normal_60037ff41b65d.pdf
Sample260806-qp417scm21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3644	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304964405073111"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{471762A9-2F7F-4C2A-B9BB-FF2D70F3FC7C}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 4944	4272	msedge.exe	85
PID 4272 wrote to memory of 64	4272	msedge.exe	86
PID 4272 wrote to memory of 3644	4272	msedge.exe	87
PID 4272 wrote to memory of 64	4272	msedge.exe	86
PID 4272 wrote to memory of 64	4272	msedge.exe	86
PID 4272 wrote to memory of 2528	4272	msedge.exe	88
PID 4272 wrote to memory of 2528	4272	msedge.exe	88
PID 4272 wrote to memory of 3460	4272	msedge.exe	89
PID 4272 wrote to memory of 3460	4272	msedge.exe	89
PID 4272 wrote to memory of 3460	4272	msedge.exe	89
PID 4272 wrote to memory of 4532	4272	msedge.exe	90
PID 4272 wrote to memory of 4532	4272	msedge.exe	90
PID 4272 wrote to memory of 4532	4272	msedge.exe	90
PID 4272 wrote to memory of 1752	4272	msedge.exe	92
PID 4272 wrote to memory of 1352	4272	msedge.exe	93
PID 4272 wrote to memory of 1752	4272	msedge.exe	92
PID 4272 wrote to memory of 1752	4272	msedge.exe	92
PID 4272 wrote to memory of 1352	4272	msedge.exe	93
PID 4272 wrote to memory of 1352	4272	msedge.exe	93
PID 4272 wrote to memory of 1936	4272	msedge.exe	96
PID 4272 wrote to memory of 1936	4272	msedge.exe	96
PID 4272 wrote to memory of 1936	4272	msedge.exe	96
PID 4272 wrote to memory of 1872	4272	msedge.exe	97
PID 4272 wrote to memory of 1872	4272	msedge.exe	97
PID 4272 wrote to memory of 1872	4272	msedge.exe	97
PID 4272 wrote to memory of 2656	4272	msedge.exe	99
PID 4272 wrote to memory of 5116	4272	msedge.exe	100
PID 4272 wrote to memory of 2656	4272	msedge.exe	99
PID 4272 wrote to memory of 5116	4272	msedge.exe	100
PID 4272 wrote to memory of 4500	4272	msedge.exe	102
PID 4272 wrote to memory of 616	4272	msedge.exe	103
PID 4272 wrote to memory of 616	4272	msedge.exe	103
PID 4272 wrote to memory of 616	4272	msedge.exe	103
PID 4272 wrote to memory of 5096	4272	msedge.exe	111
PID 4272 wrote to memory of 5096	4272	msedge.exe	111
PID 4272 wrote to memory of 5096	4272	msedge.exe	111
PID 4272 wrote to memory of 732	4272	msedge.exe	112
PID 4272 wrote to memory of 732	4272	msedge.exe	112
PID 4272 wrote to memory of 732	4272	msedge.exe	112
PID 4272 wrote to memory of 4200	4272	msedge.exe	114
PID 4272 wrote to memory of 888	4272	msedge.exe	115
PID 4272 wrote to memory of 1136	4272	msedge.exe	116
PID 4272 wrote to memory of 4156	4272	msedge.exe	117
PID 4272 wrote to memory of 4156	4272	msedge.exe	117
PID 4272 wrote to memory of 4156	4272	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://static.s123-cdn-static.com/uploads/4601649/normal_60037ff41b65d.pdf
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffe5ca9c188,0x7ffe5ca9c194,0x7ffe5ca9c1a0
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,2002916605993492117,7245935320171828702,262144 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,4075282638419030934,13250184925334551456,524288 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,14412068561118461503,16783439076676192695,524288 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,11047152826455113116,5178544501037335218,2097152 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,8483353084710847817,15867687126167413338,2097152 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,906640640464387659,16705907668440255635,2097152 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4132,i,1986671396421582033,17448656846339606502,2097152 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5068,i,1188383084470864093,2589821008609111213,2097152 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:2
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5300,i,16606546933632694446,15159879477880965512,2097152 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,15705147941144057740,4050521580877705096,524288 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,8109927286991860326,2892071589354495269,524288 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,13851491326536052877,15998455248373237745,524288 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,13851491326536052877,15998455248373237745,524288 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6596,i,4401071391546900196,11650687076865542182,2097152 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5040,i,5256974190524896457,3689403418029799759,2097152 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3600,i,14740631724865518605,7257243606305947546,2097152 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,13837845430071761329,14710654190056062220,524288 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,7112355525182867215,13642919942469564003,524288 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,14807141807276292586,13562448414153141832,524288 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=2144,i,12902475094241966233,13459597297855049064,2097152 --field-trial-handle=2460,i,16493302503084518716,16010788583645328772,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64e5e5c5-d102-4aee-a8df-15a8eee955b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\64e5e5c5-d102-4aee-a8df-15a8eee955b9.tmp
Size 105KB
SHA256 96356a1c0b2ee29ad881b49a1b821c86208118818f9f9f8a11e51bffcb2c70ae
MD5 32fd47dba5260d8b5bc72fefda67750d
SHA1 d56a3f7676f99497342f47dd6d1a4d23801da632
SHA512 b7a996f9c781113ae80e488cc2b89a328b52fb5d732c2c41e5d63687eaf4d74b0155211c7cb57278121b5a6ab39b5b0a974f5b8994a3279d8609a14cfaf1be44
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7g:fwUQC5VwBIiElEd2K57P7g
TLSH
T1F1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d6d7ff0c26a2d072b926d254243bbb47ab920f5818df4734be9d7ab9d4a116d5
MD5 1012958b01a561f3817f9a7c410a51b9
SHA1 936a78b7f9ec8236f1878cf71dff7e49c0c99071
SHA512 bfef0b36f26bf14c074afba901d3e9fff51769e31b5f8f9fca442cc4f625759acd298dcb646c1772fb4fc872ef1209cafc60d4d5039a0f81b34fce944882b4c7
TLSH
T121813C785E4748A0D703A0B379D216D0323189F7F416EAB2C59C68B0660BB9BDF2B17D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588529.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588529.TMP
Size 3KB
SHA256 58afac529ea2c2d7e0a7ab813a303cf5ce8f38e808d015ade186b1b2e6a80c6d
MD5 5b29316e51bb17a39668a6438f4b9067
SHA1 4b23e598c66814f37ab792d60ca330d7a9bf36f8
SHA512 07ccc5b5ead54e4f4581fc5bc5ba5c18168b1ef0fcf673e2b6aedf0695734ae7b006a6c8e7d64c92dc6bbe541474258f8d49b9136a21903b2a960c2a2695ead5
TLSH
T19C71F9785E4708A5D713A0B379D252C032318AF7F826EAB1C16D58B0660776BDF1B47D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3e7c3351241ccbb6f60f0a0ef928312ebf8e7f0efc7c702372d9150dc92f18c9
MD5 7fd1d1e0fbad87295c35e681cd22bc62
SHA1 ac7d9f7322f3e4e7ce8ae84cc9381f6a19570c68
SHA512 f3230db804a775c6bb4fccfb94294a76ee50ea893336be7de8730af75725c1a5251dcf0d88ce3dc8fa71cd54db18d618aa7d489fbce6c51c17b8c490c6618feb
SSDEEP 192:sxZZQUn4RpyM/jK1Ml8MkF/f3sBoHQOCodpS7HW6+WN5/eF/YIevOwPE1IgrJ:sxZRn4HMF/f3sBoHQ+wHb5c/mO59
TLSH
T10852F8126A346977CCDBD20DFA15BB53D6F81572A6940E54A9FC990C00E6AED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7faa5b365808859d2c95725f6ba062968d14e9046bb56f86cfe34f162828f82c
MD5 c89b2285a03173e75d6f389ea7b88044
SHA1 42493251044d5624bf44dfd738bfc94ad575ec01
SHA512 6ad0e98bb35319b95a13694e830c6461f457bbdedc49e2fe7e6fe5ae71744a974496d33ab11fe53fcbc7533716d293a7e92b5801753bd250cb609c0baf404925
SSDEEP 192:sxZZDUnvRpyM/jK1Ml8MkF/f3sO+oHQOCodpS7HZP6+WN5/zbXYIDvOwPE1Ig5yJ:sxZunvHMF/f3sO+oHQ+wHW5HXpO5I
TLSH
T12952E812AA346977CCDBD21DFA15BB53D6F91172A2900E54A9FC990C00E6BED331781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7b7463e03bbbefe773a9d67c36c0c859a710a41f14aff3968f5c744b949c11df
MD5 e32386b4812bab1b165965a525b9a934
SHA1 f56252229887b818051349576034385b08ec937f
SHA512 d5d0df289a28f3b3a24460c4cc5ab8c32338a8b2b0bd7ef1296af0ef14dfc4fa44e58436f9a53f8f83b8020237d3f133bd574bc48727c751df4441dcba0d9480
SSDEEP 768:RRsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9KrouCE:RRsqxXlWvJD6Tu1ja54LAs9hun
TLSH
T1D0D21B3B694CC77E4F840E5DEC26AFD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 7d394beb15ff9c875f8e6a163861679654f493907d16ba669a60b684811eb20a
MD5 a22e0791e9f2493b0bf000835c3a2977
SHA1 8b7b0b9fb77218d4e7af15aa716423a0b541404d
SHA512 1a790dc1d6a4907b54c9b389a5002c411eb5a055f0dd66fc65a7e6628c16f9d7d35438ffad9fca39bf34483aa8886bc1fb316e4c63f426518388e43cd6af5dc9
SSDEEP 96:KYbaKYIKSogKteiCQQKp2SAgKdG6Wh2KKgE:Exb7j+rt1
TLSH
T1B1E13746713B220338BD2948A76695769E4232A33458686F7FB840B25E77E210EFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 46b1481de8b86cc83d98219d58c3ff23f1999c12b36c81c3f3a252655f0f29b8
MD5 d7271435dc3a053750844267e1527e85
SHA1 17c2a9324632e7cd4bfcd2c9ed976423e9a83a97
SHA512 214ef37dd99a9e2ee6d91be0a003da13eeeb25770d2c6b6469547253b7cc937b03413fc4fce622ed8ad30a103dd5ba1614412867eeef84074834cc4d56e4dc6b
SSDEEP 384:9ZcIhsNONdib2QeVRN+Oi+p9SLnTKwBODNZOCNWOPU:lhecH+Ois9SLnewBKZOkWOPU
TLSH
T171928E716C382C775EE6A545F94B32078EF88177F6C42BA4D1EDAF1C01E659C230AC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2539cffa61c0048615c718a4f8d42ca77ee6d0f9d8d41620222d9d06a76fd8d5
MD5 91086094682a4245dd6ac492a3011063
SHA1 83e14fc16d6f9ce90fdf585820d321cd70233c03
SHA512 2af3ae51142453579b1fb95f26f3e6790d6446116596aae7b24f35c9237a16d40f90b24b4de5033782f2056db794a35470efba6b05b11e8f16fd51ad7221825f
SSDEEP 384:VZcIhsNOMdib2QeVRN+Oi+p9SLnTKwBODNZOCNWOPU:thDcH+Ois9SLnewBKZOkWOPU
TLSH
T161928E716C382C775EE6A545F54B32078EF48177F6C82B64D1EDAF1D01EA598230BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6f5b0e7e5b7135ab40aadd8ea26a4ba68bbe3dca13640894767cdd86b11692fe
MD5 bb58834d64de174abfc0e47e465f8b2f
SHA1 586bf16a8ef25e8998005234c7246135eff7ff9b
SHA512 9c9b10eff32a6fa6dbf97bbc507d9c38d9f5a15d05cac1cf7897b1a794790b3f776f2ce048af66abec71edafe530acdc54a9b889586ea161ca1a03c3f123522e
SSDEEP 192:tONd6JkRtQmiUyrpW+RN+OmJ+Nh3URCU6:tONd6UrOW+RN+Oi+3ZU6
TLSH
T16B02E835AD382C7B9EF26E49B58B27175FA8203BEA856F90D6D81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b3d929cf096b1bae2f72e70b865705ef8c81295c9fd84a8b444ee2db32ec245e
MD5 78cdbc3145a073893209fd5f8c67a65f
SHA1 e0d64d0153e3eab4c6f60200341fe237abbc6cac
SHA512 91da41f5cab7360736d4e9b66fe77e6c322d1b0408300ff1d487a886f2ee4d9d21569fbed04732e89aa35d6ece15aea44982846dd67e641adaa8d87e2b2a0eb2
SSDEEP 192:9ONX6JkRzQmiUy6pa+RN+OmJ+KG9bVcFqSPU6:9ONX6UlTa+RN+Oi+p9SLU6
TLSH
T130120A3668385C7B5EE36545F58B31175FA4513BEA896F90D1DC2F1C01EFA9C230A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e102143a90c98fee41dc808bf0feca626927794268b384c0375b03a3035310cc
MD5 d8d040395c0cfa5c27f370ab684f340c
SHA1 c18a060bb8a050c5f837a4ce8d9acc07c34bda2c
SHA512 4520a017e5130cdce0cfda61936997c658c0635e8ba760685fc76cefa85bf20782b56ac37b8955443e8eaa02c5d6a394acf027b48aa20cbdf49e9dfeabab52f1
TLSH
T18541E658AAF91148B3B76E5AABF6A86E487EB9772F06D55D10010D4E0A22F40CC72737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads