hxxps://subscriptions[.]pstmrk[.]it/unsubscribe?m=1[.]eEI5fafiju0h4Kl0VH8Zmw[.]tqSXGs-TcMbH6UKx4F0yTJCfLrpnNE15uC_pscZ6CV68SOtNzOeSVUVR--aahtQt5yDYTV2H9A66iFBs7PvbJeXLynNfZ3LEYkjdLiVwd6WSLZNEjRvx3VG1ymH-Kwf1ChpL6sZZRhuQpt8A38OsGl2Io5RiJdr4tEEvQbY0TuYMEb1C9SmGTOplql50BYslXHm1KVqpVXvDY_mydWBbJ1slD_RZfmKLM9FYC3rUHqHqxKkLiNfAJj1HJhC1zVnpkpSA4I4SR59S521DWM41wkPVylVLXMzo4rdSEm3yLISxt_tZHutlllL_s6c6uXzwYVSw-4ePL3c5RERYxZPayU2hpDED7kLLwjxNDqeZeixrm-MeR2R2dc5XB4vLI0-NMKAHBgOoP1OBsNJRk7hpBAs_YaCpEEsmH819aGqIo8WbmCjHxwXVWa0EeCSBxSPfhJHTvcytxlOzgwfpv4urlg

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://subscriptions.pstmrk.it/unsubscribe?m=1.eEI5fafiju0h4Kl0VH8Zmw.tqSXGs-TcMbH6UKx4F0yTJCfLrpnNE15uC_pscZ6CV68SOtNzOeSVUVR--aahtQt5yDYTV2H9A66iFBs7PvbJeXLynNfZ3LEYkjdLiVwd6WSLZNEjRvx3VG1ymH-Kwf1ChpL6sZZRhuQpt8A38OsGl2Io5RiJdr4tEEvQbY0TuYMEb1C9SmGTOplql50BYslXHm1KVqpVXvDY_mydWBbJ1slD_RZfmKLM9FYC3rUHqHqxKkLiNfAJj1HJhC1zVnpkpSA4I4SR59S521DWM41wkPVylVLXMzo4rdSEm3yLISxt_tZHutlllL_s6c6uXzwYVSw-4ePL3c5RERYxZPayU2hpDED7kLLwjxNDqeZeixrm-MeR2R2dc5XB4vLI0-NMKAHBgOoP1OBsNJRk7hpBAs_YaCpEEsmH819aGqIo8WbmCjHxwXVWa0EeCSBxSPfhJHTvcytxlOzgwfpv4urlg
Sample260806-repzzaxvc1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4048	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304988067775383"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{DA3E506D-64AF-46E6-840A-23C1A29115A8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 1500	3976	msedge.exe	85
PID 3976 wrote to memory of 4048	3976	msedge.exe	86
PID 3976 wrote to memory of 2112	3976	msedge.exe	87
PID 3976 wrote to memory of 2112	3976	msedge.exe	87
PID 3976 wrote to memory of 2112	3976	msedge.exe	87
PID 3976 wrote to memory of 4352	3976	msedge.exe	88
PID 3976 wrote to memory of 4352	3976	msedge.exe	88
PID 3976 wrote to memory of 564	3976	msedge.exe	90
PID 3976 wrote to memory of 564	3976	msedge.exe	90
PID 3976 wrote to memory of 564	3976	msedge.exe	90
PID 3976 wrote to memory of 4140	3976	msedge.exe	91
PID 3976 wrote to memory of 4140	3976	msedge.exe	91
PID 3976 wrote to memory of 4140	3976	msedge.exe	91
PID 3976 wrote to memory of 3480	3976	msedge.exe	92
PID 3976 wrote to memory of 3480	3976	msedge.exe	92
PID 3976 wrote to memory of 3480	3976	msedge.exe	92
PID 3976 wrote to memory of 3528	3976	msedge.exe	93
PID 3976 wrote to memory of 3528	3976	msedge.exe	93
PID 3976 wrote to memory of 3528	3976	msedge.exe	93
PID 3976 wrote to memory of 2052	3976	msedge.exe	97
PID 3976 wrote to memory of 1840	3976	msedge.exe	98
PID 3976 wrote to memory of 2052	3976	msedge.exe	97
PID 3976 wrote to memory of 1840	3976	msedge.exe	98
PID 3976 wrote to memory of 4464	3976	msedge.exe	100
PID 3976 wrote to memory of 4776	3976	msedge.exe	111
PID 3976 wrote to memory of 5116	3976	msedge.exe	112
PID 3976 wrote to memory of 2852	3976	msedge.exe	113
PID 3976 wrote to memory of 468	3976	msedge.exe	114
PID 3976 wrote to memory of 468	3976	msedge.exe	114
PID 3976 wrote to memory of 4860	3976	msedge.exe	115
PID 3976 wrote to memory of 4860	3976	msedge.exe	115
PID 3976 wrote to memory of 3292	3976	msedge.exe	116
PID 3976 wrote to memory of 3292	3976	msedge.exe	116
PID 3976 wrote to memory of 2004	3976	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://subscriptions.pstmrk.it/unsubscribe?m=1.eEI5fafiju0h4Kl0VH8Zmw.tqSXGs-TcMbH6UKx4F0yTJCfLrpnNE15uC_pscZ6CV68SOtNzOeSVUVR--aahtQt5yDYTV2H9A66iFBs7PvbJeXLynNfZ3LEYkjdLiVwd6WSLZNEjRvx3VG1ymH-Kwf1ChpL6sZZRhuQpt8A38OsGl2Io5RiJdr4tEEvQbY0TuYMEb1C9SmGTOplql50BYslXHm1KVqpVXvDY_mydWBbJ1slD_RZfmKLM9FYC3rUHqHqxKkLiNfAJj1HJhC1zVnpkpSA4I4SR59S521DWM41wkPVylVLXMzo4rdSEm3yLISxt_tZHutlllL_s6c6uXzwYVSw-4ePL3c5RERYxZPayU2hpDED7kLLwjxNDqeZeixrm-MeR2R2dc5XB4vLI0-NMKAHBgOoP1OBsNJRk7hpBAs_YaCpEEsmH819aGqIo8WbmCjHxwXVWa0EeCSBxSPfhJHTvcytxlOzgwfpv4urlg
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa710cc188,0x7ffa710cc194,0x7ffa710cc1a0
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,5491066406268242213,15198759148480016886,524288 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,11330157407728328198,4899535793829564398,262144 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,9097223599979337773,11422106613075528412,524288 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,18155732993352089688,9127801503870575043,2097152 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,11654999722540200497,9887392477233781824,2097152 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,8819194708817639373,1828886180483414814,2097152 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4380,i,384712148729326043,14572994986370352628,2097152 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,568539725677915878,6204911602553077668,524288 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,11161018872411863244,9104702101286699748,524288 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,16383860674106619046,1868189265786284161,524288 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,16383860674106619046,1868189265786284161,524288 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,9619175286051562931,7325895808871974227,524288 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,15047352527699240204,10991613244086426530,524288 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,13387750098737762825,7803954387262731611,524288 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3012,i,11631543669163392251,17824236795082719767,524288 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,10399627105371680363,15052406448450637986,524288 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,12820964924092880427,16071666323797786556,524288 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6088,i,18214577084621685833,16300348353702795774,262144 --field-trial-handle=2040,i,6097002312246915036,5344199648455574107,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44706d76f1ece5a4d450e10d3b99aaf6820a25cca350bb58e108f0eb115cafbf
MD5 e3ca4a53a76897ebcd14d64f6a91d351
SHA1 02ab68c2bc82cd6a3f6b7d691753996336593f0b
SHA512 449237f2d46cb6821e353c75c34e76857d89b96f47ae72e02f02c026193c256f1ec96ce821516fec0eede00a9e60c3f50b24c42e73da1cdebd39d67dd09fa676
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
TLSH
T1F4B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 7786c9e7791249de10a6fd1bee7d58c18d164b1d3c908ed771f8674cd377c74f
MD5 13cdf7f458512216292f86d43c04faac
SHA1 6ee86f36b15b162adc0c7e004b0ad3578b32d196
SHA512 a5ec8c380c8eb5cb37db6b65fa5e31283c4dc86efe706c687b679afa953f8444067f95c283cb83ec17471e9b218ae81a7f39f4613659639d88c285d5c8f13c35
TLSH
T130E026D506CEC26E9604A4C79278674DC2E03B1E9AC9AE8E170484C4F043894E7C6DA4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9168d7d94141095f621625038317d557bad1a60531d267cfa1b1d409bcb49d66
MD5 9197882c2da638147a0438e3fd2e1e45
SHA1 73a0c838e623c089c79a0c95ed32ee6b0605e242
SHA512 a47a56cb9b25118886cff6e5b64076144c3ce8d3fb6622b3036714c767a03c4cf7f67f023f33be7bcf11057f03fb0d27ca43e5679809c21f7664219d8c44a307
TLSH
T18D714FA241B34552F7ED2671D0F23646327EFAD50A0B8F6AF1ECE47FA91E725C816008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b198.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b198.TMP
Size 3KB
SHA256 6f73c49a685da326305fd3f7604f24f324eb2b71ce02e0c1aed7bdeebd609d67
MD5 5e6320fd32ac65b48b4bd8d3c8fce08b
SHA1 7e1c40f2c9d1608d53c49549f672dcf1e306ab06
SHA512 778d518f432c07b1ef480cf40c168749b489cd22b43f5de3944845fcbd30e2cb9ae670eadc4bdd6d8659037552ef826a990ba10197b3502366df40a9419cba74
TLSH
T196714FA241B34651F7ED2231D4F1364632BEFAD50A0B8F6AF0ECE47F991E725C816008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 60ce5c9d8c0e97a9ec725b6e35459226d21049b09d6afa4e5146e1f1b2c3dcbb
MD5 8ec45dcffeec8a5b410b95067ae06047
SHA1 e530790bc23fe435be18f93f9c1f0a7f7357957d
SHA512 06561c4f4973529823b33c4a2a1d67cc2964386a9c0dcc0c4decfaec37bfd56f8191266a64c30c7ccafd27343476d6b334dd54fb37e2f6a03805f0cd585c714e
TLSH
T1081157F387E585AE8E5156F06A24AE2BCE2D0606431C7C2989D4FF2B93E3476E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6c49d3ea990e62b8c81f427e9d7ea77c85245456255a5a2a6b4cd52bfc42a754
MD5 24e642a9a8d7a093f3adaa738f10cd68
SHA1 dbd98ac3ce07089bf969086095ce850ec6c74c15
SHA512 1994231012b9af4c8cd557a81ff336cbdd85df460a3102b99faeff95d3c1e0eba811fb16f6d4d49254c1b3a61c49cb0cd347414e4cbbcafcf6904d1ba8f2566f
SSDEEP 192:sxZEROyM/jK1Ml8Mke/fosyQaKIdpJHW6+WNGYLl1AjIgrJ:sxZE4Me/fostaDJHbGF9
TLSH
T1114207116B346977CCCBD20DBA45BF53D6F91532A2940E44EAFCDA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c4921559008abf12c58acdcadf91ef530a966a0e3afd6eb59696107ff9cd2fb0
MD5 786663366d371b1a6ca86ffcb5c38957
SHA1 f1e17e6df4dc7109168799e08d153a86d601dc80
SHA512 383d064664749e80c7373faf665679b5facc880c4bd692d38f1fe20201b5aec39a7881be3399b20a6cd8ccba65ee1db0006b94b390f232ca5b0081e47d6f0c8a
SSDEEP 192:sxZEROyM/jK1Ml8UQQke/fosCQMjLIdpV8HW6+WN87Q/YLqczjIg5nJ:sxZEYqje/fos9eUuHbX/iH
TLSH
T1745208116A346977CCDBE20CB941BF53E6F9557292940E44EAFCDA1C00E6AED321782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4b02ffacd5660aeb6c9b3ebadcf1d6d92618002d661b98dd98ff3448a3a1f312
MD5 8bb0d855531e5fe5750b7c52c37f4ad6
SHA1 318c0b63a3af2d457ea5c3e5743ee7a65ef9932d
SHA512 d7dedc4b2ddf7d42575d321c7d4a9041634d6590c6e606b230af8af779a3bf5a7cfe90b485868e9021f5bb76096e5e1416ad4e47f5493442fbfe899cfb7e10c6
SSDEEP 192:sxZEROyM/jK1Ml8Mke/fosCQaLIdpP8HW6+WN87Q/YLC1AjIg5NJ:sxZEYMe/fos9aUUHbX/wh
TLSH
T164520811AA346977CCCBD20DBA41BF53D6F9157292940E44EAFCDA1C00E6AED321782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e696c0734a476c1c00ea83df0109215b40035c704b1c4a85ab0320b779522410
MD5 5be310262e9c4dfa221680fa9f08261a
SHA1 5eb137946a7f1448d4246bbe9cda4b1d460cd9c4
SHA512 fabcb1278f394239ce713bd2385bdde44eff1701a088fbb6ebe65ad94ea138a31329277dc7fcfb786846ae9481b82963878f2f9920a35a70e0c49b3c29fc9b5f
SSDEEP 768:7Ts6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNdroj8Pg:7Ts6pD1WvxzWju1jahILIsNWj8I
TLSH
T1BCD2FA3B680CCB7E4F844E5CEC2A6E967DD801CBAB98895447FA844C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 f7d996c1d44ad10381367a5c3b2824f47b2ae953204857fcef98986474303b31
MD5 c411de84b7c6e67bb3e6b66ac546dbd8
SHA1 9d93edc0588b79073de4714e74c7d81576782730
SHA512 43adcc6a18b292add51b5963ee967c461150b1772b72a104cb6e4a24efd18dfe12dd927792ad2933e4022052d7737361ea5d0c7a64d4584696cc5240f7086c8c
SSDEEP 96:KUAAKtePWNKKu0S+FeKWchsAK9aOy+YKT6v:iiJFxhjnE
TLSH
T195E1495673BB02023C7D3B0992D5976B8E82B1637018A46B7BED04728E66E218DFC5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79787b90-1d47-40dc-aa22-e2ca2c4db7a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\79787b90-1d47-40dc-aa22-e2ca2c4db7a4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 798c6673a75c361f0799106ca48cac901975152eed80b0720675a92d13a25dfc
MD5 274e7bcd72445e5cce8a59048e50c418
SHA1 4e40392644ff752bf8a2b7af9d7341282dcd653d
SHA512 ed1b362b67b37f8ec133ec60fc25eea34f20324aeb896535e97822be058b67455bf3292f370dc454ec0065d7c84cde6ff66deb449f9b47f309b92476e75f0925
SSDEEP 192:uYLsNM5mQk2nZ7+3vCUQmiU1lbk4atb0M+Fdsh2ue7N3LMsqTjXuU8:tsNM8JAyLDba9OdsMBIxyU8
TLSH
T10B32293168386C775DA3F645F5873A139FB45127DA8A2F90D2EC5A1C01EF6AC230682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4fcc389b8380b3d0d2721cda28e7e4b7148daf03fcde081f00dc845244c743b3
MD5 e312aebd4c1047100435a15abc4289f1
SHA1 94c341ad7d162c56fd408d1ecb21e8172b4a63c5
SHA512 101a2ecef3b4b961d05fb006624711c86268f7d3ce91264ddfcd5a851fe8f1be8091e90775aeeb582ac958122ec2932a7690c90a1600e4908343a255c9a91fe0
SSDEEP 192:uLLsNM6mQk2nZ7+3vCUQmiU1lbk4atb0M+Fdsh2ue7N3LMsqTjXuU8:4sNMJJAyLDba9OdsMBIxyU8
TLSH
T1BC32193168386C775DE3F645F5473A139FB45127DA8A2F90D2EC5A1C01EF6AC230792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 61e401467f6768c2583a6473389d87b90ec6999e043a5117276df6a2c0a9402a
MD5 229674bb97fabdb8ac01bebfb5951a71
SHA1 71176780e52d703305b7581e632337311cd1eed4
SHA512 30cb35cc319faf859bb262852e04fe680b070a9c3b5b328ba42a05e4b0b14262e88b76501e62dd768a24a6c645175dfc8b4f2d3e34a973cc74e76ed6459f2646
SSDEEP 384:2iFiZcIbzsNE8TUNTUlIlvJAyLiba9OdsMB5xynTKwBODNZOC+WOPR:dFQPNwgDAx+g9xynewBKZOHWOPR
TLSH
T13CD22AF248E75836D9AEA707A77E2D034EBCC163B5856650B39C9A0CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f6f2bec4d86ad6c8140adc738cab4e79f26717c9cb13f32938bd054d68a990be
MD5 4b130bd15912b28ae90305eba5e3b0e4
SHA1 9ce6b4c3bb72c0b4b878b0b30a47723ef78b9635
SHA512 7c6aea647819a0940abf258035587326af806d8280cf9f0590f510f84357819e11bd79df83a020c1095826c7ff224702919eace75f4a5ce786295b7475bce02d
SSDEEP 192:qONq6O7+3hQmiUywsGttb0M+Fdsh2uPgGNFU6:qONq61AGt9OdsMU/U6
TLSH
T18C02E835AC386CB78EF2ED0AB5872B235FA5113BA9952F45D6E81E1C00D765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d0d45b307be3b6a868091246433dbd80a27af0ae050ba1e1f0dc2017bdbe4858
MD5 219e0b38b14e2fe918815cf5dc20f53f
SHA1 43e023f4fe12cc74082ea52f11083a296ad42d18
SHA512 a032ae5fee5356ffa9ceac06427b801cd432af44c1f148aaff74a42858e26b3ef601536f91f78f5164ff84cbab50ec4aa676d89bdd8e8cd14209429afad16abb
SSDEEP 192:mON96O7+3SQmiUy2s5ttb0M+Fdsh2ue7N3cNsqTjXuU6:mON96sc5t9OdsMBkxyU6
TLSH
T145120931A8786C675DE3F545F48736134FA5412BDE8A7F81E2EC1E1C01EFA6C234682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55650e97-0696-42f8-9e15-e6febcdec6f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\55650e97-0696-42f8-9e15-e6febcdec6f3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9708ead98a13a718aacd42347baf395ca0065ea4964c97bd8fd12b9649a9d9fd
MD5 926f7863877c07f2ca4ea1f8aa9a1d12
SHA1 1ae8cd774511dff3da31c800eeb7daba6ea76249
SHA512 e89c5254624fcdfecfae2361f39767a72467a5aa71519c2c2a6f4ac1ec9a7781522b91818c96a6c406a586918c4a920ea826aa46dfe2b32f4ffad7792a538a6a
TLSH
T17F410968BAEA1148B7B77F1A9BF6A96D447F79373E06D45E10010D4F0A63A40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download