hxxp://sync[.]pmbmonetize[.]live

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://sync.pmbmonetize.live
Sample260806-thd3zseq9t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1196	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305057985795379"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{6EA55C6A-DB45-40C0-90F8-B05216CF97DC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 4220	2340	msedge.exe	84
PID 2340 wrote to memory of 1196	2340	msedge.exe	86
PID 2340 wrote to memory of 4028	2340	msedge.exe	87
PID 2340 wrote to memory of 4028	2340	msedge.exe	87
PID 2340 wrote to memory of 4028	2340	msedge.exe	87
PID 2340 wrote to memory of 3524	2340	msedge.exe	88
PID 2340 wrote to memory of 3524	2340	msedge.exe	88
PID 2340 wrote to memory of 4812	2340	msedge.exe	89
PID 2340 wrote to memory of 4812	2340	msedge.exe	89
PID 2340 wrote to memory of 4812	2340	msedge.exe	89
PID 2340 wrote to memory of 4356	2340	msedge.exe	90
PID 2340 wrote to memory of 4356	2340	msedge.exe	90
PID 2340 wrote to memory of 4356	2340	msedge.exe	90
PID 2340 wrote to memory of 3344	2340	msedge.exe	91
PID 2340 wrote to memory of 3344	2340	msedge.exe	91
PID 2340 wrote to memory of 3344	2340	msedge.exe	91
PID 2340 wrote to memory of 3980	2340	msedge.exe	92
PID 2340 wrote to memory of 3980	2340	msedge.exe	92
PID 2340 wrote to memory of 3980	2340	msedge.exe	92
PID 2340 wrote to memory of 4712	2340	msedge.exe	96
PID 2340 wrote to memory of 4712	2340	msedge.exe	96
PID 2340 wrote to memory of 4712	2340	msedge.exe	96
PID 2340 wrote to memory of 4668	2340	msedge.exe	98
PID 2340 wrote to memory of 1128	2340	msedge.exe	99
PID 2340 wrote to memory of 4668	2340	msedge.exe	98
PID 2340 wrote to memory of 1128	2340	msedge.exe	99
PID 2340 wrote to memory of 632	2340	msedge.exe	102
PID 2340 wrote to memory of 2572	2340	msedge.exe	103
PID 2340 wrote to memory of 2572	2340	msedge.exe	103
PID 2340 wrote to memory of 4284	2340	msedge.exe	108
PID 2340 wrote to memory of 4284	2340	msedge.exe	108
PID 2340 wrote to memory of 4284	2340	msedge.exe	108
PID 2340 wrote to memory of 4328	2340	msedge.exe	109
PID 2340 wrote to memory of 4328	2340	msedge.exe	109
PID 2340 wrote to memory of 4328	2340	msedge.exe	109
PID 2340 wrote to memory of 2456	2340	msedge.exe	114
PID 2340 wrote to memory of 1396	2340	msedge.exe	115
PID 2340 wrote to memory of 1916	2340	msedge.exe	116
PID 2340 wrote to memory of 3236	2340	msedge.exe	118
PID 2340 wrote to memory of 3236	2340	msedge.exe	118
PID 2340 wrote to memory of 1396	2340	msedge.exe	119
PID 2340 wrote to memory of 1396	2340	msedge.exe	119
PID 2340 wrote to memory of 1640	2340	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://sync.pmbmonetize.live
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8bdddc188,0x7ff8bdddc194,0x7ff8bdddc1a0
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,692424397353572500,16116348774431260034,524288 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,4590458839687533773,15568704484307353877,262144 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,11884824661153023041,10325807520571365969,524288 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,6480886119857969476,3346604181957187423,2097152 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,252883917288016730,2539212786819515198,2097152 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,6845969129262578578,11227174644262604375,2097152 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,4917027474343591031,16956822394953172528,2097152 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3688,i,5147038991212162967,3452452283329112253,2097152 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,9282404228232106613,9960171128185433031,524288 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,9535164162915489895,10467794727574438753,524288 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,18423618617116512808,7117072754742660770,524288 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,18423618617116512808,7117072754742660770,524288 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,5044879815759898035,7236722141936374074,524288 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6576,i,1980194728993089095,6577511361530434755,2097152 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4028,i,15519837383207397433,13318416823494500894,2097152 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,2738584927612173605,7096905147068993286,524288 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,11904412965152213279,12339402702299006839,524288 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,17729996693569829993,10808267053612071540,524288 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,16085825346013743144,16279841237800332670,524288 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,2391768690160981734,6526060695316416926,524288 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,2485976852803079254,5435281780633652495,262144 --field-trial-handle=2352,i,4598956015764976998,4638184218870955676,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2105e1560899e5ca15e8479c23d3a8dac5e7937ebbd6f6ae702db30b9f408f25
MD5 25be0853b90f23c0cbd17a911e651c35
SHA1 c4b7fa01b2e7ac0e238be90a58a574a43a60563b
SHA512 4cdc45f7bf15a6c3cf228a222458344fc7579aec162b8c3d204abd7e0c0943f0c3448ae84b4dd0673cf9c296054bd9a39b35ab733081a95a4b1aaa35021bda3a
TLSH
T196616D3BCA12C463FB6602B298D301EA74BF89ECF4179E8D1113597D371CB2AC229784
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5853b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5853b9.TMP
Size 3KB
SHA256 11fd1b6cf6331c41a15c3287191fb09febe68736907a407819852cb27998ccc2
MD5 67e4df4eaf9e97b0ed962aca3a4dd097
SHA1 8a8c5a7d519b36fe9e76fa0d4f2bd22b75433d84
SHA512 bcf34991119fc009c18275cde88e1629ae04daa9c5a629b037ba3f853818914e7368a0ef819b2b374505bd6f57feca36164c584111b1ab9078927dabaebf83b3
TLSH
T1E6615E378A11C463FB6601B2D8D302DA747F89ECF4175E8D1117157D7718B69C228384
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 b516d89f2760866df2dd68b393f2784de34e8e0a8da15bcd3919800172fb790f
MD5 f99c3cb367de222f647b39d8a87112fa
SHA1 660fb38ffba5d76505e5314693de00f71dc19f58
SHA512 fee2f4da5ff72d79cd37e35fc85eb4ca454a8ad5cc1f1e86fef7df86f00c5cb9501447758377cf200f2115f9cc151079fd6dedf29fd8ff88c05e98e1f48719e4
TLSH
T14A112BF7C3E585AE894156F05A24AE2BCE1D090683287C2585D4FF67D3E3479E10255B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 44cfc4ba6e34801bd836d7e4a734247e75d3f0326046c3ba24ce76a5224a8f87
MD5 44038dce76f15950eb8d6590803bb1e3
SHA1 138cf8a7826136fa88574bcb87d5f9c8dec0c381
SHA512 d6a92dd49889c8bf9aa49210525e679bafc21eff7cb367911b3abcc0c47e41a05855e2926684f04a5558c8cd721a48ad86cc559e03412cfc4fac87acf4c1625b
SSDEEP 192:sxZ5RTP98/fms41zzIdpTAHW6+WN7hO/YCJHrRHIgrJ:sxZ5xF8/fms4hsMHb8/RB9
TLSH
T1E922D8526E28A97B8CC7D61DBB15BF53E2F95032A5D01E58E6FC861C04E7ADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ac05070fa71a26501ff9ca73c147c9f2bbb7186b97679c2552d018c9cf270fcb
MD5 6b69bc47c5181d0c7d9d5614c6b2a588
SHA1 a9fb49bb50c8219c53dc020f9d49e7595a9be937
SHA512 f7e180f77220d330a9e0b7d6b1444d02b37ee6fc3009950c3b8842cd02e145f23b63dac7a0020a4705316e492b63ae14ed3f250d6a927f89e918efec5de4efa6
SSDEEP 192:sxZ5RTP98/fmst1pzIdpTAHW6+WN7a+XYCGrrRHIg5uJ:sxZ5xF8/fmstbsMHbjXYBc
TLSH
T11C22F8526E28A97B8CC7E61DBB15BF53E2F9503291D11E58A6FC861C04E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7673fac8ced3d8aaccbbdef3d5eed0b846a24a6b40d49b84fe7ca61007d17c16
MD5 335ae319cc661590c7002d10bb68adef
SHA1 9c49f35287d9fbab28ea811ffa8d811a45996e13
SHA512 8072fa899176f4ce5e84d5f21734c3e8a0ff6ffd033b0ea821298140eb4cdaf4fe932277e3ed980b80d5fa23e96c578cd0924a3613d5bf0f8d3bf2969078b440
SSDEEP 192:sxZ5RTP98/fmst1zzIdpTAHW6+WN7hO/YCJHrRHIg58J:sxZ5xF8/fmsthsMHb8/RBu
TLSH
T19922F8526E28A97B8CC7D61DBB15BF53E2F9503295D01E58EAFC861C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5b53211a93add39d9caa4b1e62962d56bc57bfc6b4d272111e6b61778d0ebea4
MD5 f437072b4b4cc7ffe500641493727eb0
SHA1 c96e23457528a44f5c8899cbe29b4b6dcdfaf76e
SHA512 0fa33debd112ec7156d957dd34d4fe1920c9bf327336142253df585f9bcce7e52cd7631f09f35d687861f45f9b11891766839bc477d78d785e98a71385669a2f
SSDEEP 768:0QqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrTro9N:0QqbUj+WvSCs6u1jaaZLbWrgb
TLSH
T181C2D83B240CCA7E4FC01E9DDD5A6F972EA802C7A7588D4447FA994C02C77EA512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa997bc8-fb9a-4cd2-8a4b-b21c94110edd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\aa997bc8-fb9a-4cd2-8a4b-b21c94110edd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 41539a266b4c1fcfacfe84fe9b5b4e32f30faf4ae6b5445e7ec485e326f6d5e0
MD5 090ba4ee05b2bd984b82e742409cdd24
SHA1 ac5ee7cf8d8429c76df78a4ee4c04bb8c4b9ad01
SHA512 40c786f530127f37f6175b1cb751f98c8f2fb871763837aca0399843a99dc9abe2670285653f09739f915e2c67b5d71e7119284ad64ce8b1aeee8ae1f916c629
SSDEEP 384:MZcIhsNdqcszgvBf2Ea+edyjr+L/XEKqfPbQEiJflBcMJBur:ahrzyfla30P0/XERPbQEixlbBur
TLSH
T189929E725C38AC77ADE6A555F44B36179FF8C063E6C96A80D9ECAF0D00DA96C0317C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 708d40abee26bd4a231dec89dd7b251d259efd7eea2c45ab8639f70356ef9906
MD5 0aa07ef36c4bd256d4f3f590df960612
SHA1 f61851af8d9db172723f201117eedc88490046c4
SHA512 90f7a7819e233d5a4f3c303d152221b0116509d5a17b207b40f3845d568fabe80f0ba92790d74b93a8f3c8b66dbb22f9a22c4ed83c6e4b540e3c62160fa01777
SSDEEP 96:EqONkiQsjpf1bxX5ih/cIPURHl8h4otop5znDFfBfPgvE5BzatIRdy+0Uf+FdCaO:vONu6Db6QmiUyfPHBa+jN+FdCtRgupU6
TLSH
T11002D73568786CBB9AE26E49F48737275FE4203BD9962B50DAD85F0C00D765C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 09864186fdd91b1ff22d5c27bc90746fc6ff4ecc5b4bfefa49aaa3e8cefe5fff
MD5 c8568b6338be2a726e88ffa9da86df50
SHA1 553ad680b02d6b1d539726690ccda6504f5ff1b9
SHA512 9abeef115192c887bbcd3524f263467427cd7638fe32ab82ff51a3a0468b552afb8340643ce733015d5def7e2a5403575d2fd954a62a53356bd50305d1135794
SSDEEP 192:EONw6Db3QmiUyJP6Ba+jN+FdChHtF4Nz+CrqrU6:EONw6hq6Ba+edyjY+LU6
TLSH
T1AA12193668686C7B5DD27C54F8873613AFE59127DE8A6B90D6DC5F0C00EBA6C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6c5b614a314d1e8bf6bcf5177e4f1d3ca9e6120e2a6fcb096ddff5d79cb78fcc
MD5 91b3f75b3021995c6ff7904b100c3401
SHA1 cde5e29f9fdaeb29398eddc6325ad8fee3fbfee8
SHA512 59b41af9882a780b4625ef4a4f2af9c67cfe509112f6795c67a222f509c67a92c2b35f81c7cfc677fce415330e77a7f755c2ea198ebd1be2d8ae3c713d852839
SSDEEP 384:xiFiZcIhzsNn8TUNTUlIlvcszgvLf2Ea+edyj6+L/XEKqfPbQEiJflBcMJBur:YFQR2wgxzUfla30+0/XERPbQEixlbBur
TLSH
T190D23AF208E7887AE99E5B47E77E2D139EBCC063B5855950B7D85A0CCC960BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d83b9a11adaadcffe380592eb1c08533e5ce98387a08db76f1aebc7d7e690508
MD5 c818b628e8812261cd6ea6645f6b19c9
SHA1 05b53fac4a7a62c1667afe7fabf4157b0ef38acf
SHA512 d10f60f8dfe2a71e198ee5bbdff883d7ea25fdfa2da99d93c2a8decb8c45038ce5c34ddc39f7b63c744b05170cae669a991aabe258adb85a73f775c759ca384b
SSDEEP 384:CZcIhsNdvcszgvMf2Ea+edyjr+L/XEKqfPbQEiJflBcMJBur:whyzLfla30P0/XERPbQEixlbBur
TLSH
T1DC929E725C38AC779DE6A945F44B36179FF8C063E6C92A40D9ECAF0D00DA96C0317C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eaa795f9-7e35-48b4-9d60-5867ef9ec486.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eaa795f9-7e35-48b4-9d60-5867ef9ec486.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b58c9c1416d535cd4701f14997f83f67e65c4954daacf31827a4ff540b64aa97
MD5 4f0c0b103053b157859cd032bdfb6aae
SHA1 6519fd6880797e28aca5df734fb9376a5468f7b4
SHA512 69d8ff24573f8227c3e8842c2a92015da1bea46b592af0770b575cf8876c00f8e14884a4071779b2d4575f1649478314eb51cf5cd72720c4e89de99cbea01170
TLSH
T14B41D698A6FD1148B7B72E5AABF6A86E447FBC772F0B945D10010D4F0766B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download