hxxp://teleapass[.]cyou

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://teleapass.cyou
Sample260807-defveawekf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
692	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305449134557942"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{190715A0-E224-4BC9-9804-71E8A13F7F76}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
996	msedge.exe
996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1584	1536	msedge.exe	86
PID 1536 wrote to memory of 692	1536	msedge.exe	87
PID 1536 wrote to memory of 4264	1536	msedge.exe	88
PID 1536 wrote to memory of 4264	1536	msedge.exe	88
PID 1536 wrote to memory of 4264	1536	msedge.exe	88
PID 1536 wrote to memory of 1708	1536	msedge.exe	89
PID 1536 wrote to memory of 1708	1536	msedge.exe	89
PID 1536 wrote to memory of 3652	1536	msedge.exe	91
PID 1536 wrote to memory of 4512	1536	msedge.exe	92
PID 1536 wrote to memory of 3652	1536	msedge.exe	91
PID 1536 wrote to memory of 3652	1536	msedge.exe	91
PID 1536 wrote to memory of 4512	1536	msedge.exe	92
PID 1536 wrote to memory of 4512	1536	msedge.exe	92
PID 1536 wrote to memory of 3608	1536	msedge.exe	93
PID 1536 wrote to memory of 4624	1536	msedge.exe	94
PID 1536 wrote to memory of 3608	1536	msedge.exe	93
PID 1536 wrote to memory of 3608	1536	msedge.exe	93
PID 1536 wrote to memory of 4624	1536	msedge.exe	94
PID 1536 wrote to memory of 4624	1536	msedge.exe	94
PID 1536 wrote to memory of 1156	1536	msedge.exe	96
PID 1536 wrote to memory of 1156	1536	msedge.exe	96
PID 1536 wrote to memory of 1156	1536	msedge.exe	96
PID 1536 wrote to memory of 1028	1536	msedge.exe	99
PID 1536 wrote to memory of 1028	1536	msedge.exe	99
PID 1536 wrote to memory of 1028	1536	msedge.exe	99
PID 1536 wrote to memory of 2816	1536	msedge.exe	100
PID 1536 wrote to memory of 2816	1536	msedge.exe	100
PID 1536 wrote to memory of 3488	1536	msedge.exe	101
PID 1536 wrote to memory of 3488	1536	msedge.exe	101
PID 1536 wrote to memory of 4244	1536	msedge.exe	103
PID 1536 wrote to memory of 4652	1536	msedge.exe	107
PID 1536 wrote to memory of 4652	1536	msedge.exe	107
PID 1536 wrote to memory of 4652	1536	msedge.exe	107
PID 1536 wrote to memory of 820	1536	msedge.exe	117
PID 1536 wrote to memory of 1416	1536	msedge.exe	118
PID 1536 wrote to memory of 3640	1536	msedge.exe	119
PID 1536 wrote to memory of 4740	1536	msedge.exe	123
PID 1536 wrote to memory of 4740	1536	msedge.exe	123
PID 1536 wrote to memory of 4740	1536	msedge.exe	123
PID 1536 wrote to memory of 1828	1536	msedge.exe	125
PID 1536 wrote to memory of 1828	1536	msedge.exe	125
PID 1536 wrote to memory of 3936	1536	msedge.exe	127
PID 1536 wrote to memory of 3936	1536	msedge.exe	127
PID 1536 wrote to memory of 3936	1536	msedge.exe	127
PID 1536 wrote to memory of 996	1536	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://teleapass.cyou
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x298,0x7ff9cffac188,0x7ff9cffac194,0x7ff9cffac1a0
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,18389055126485067040,3806337532575984574,524288 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,11971110910429744264,2707865192472671386,262144 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,13966630996419002516,8699106519629487320,524288 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,617226345485101078,14578186950966207627,2097152 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,9996542707581155848,9602536219124242914,2097152 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,5368944770832879108,1562025299702769694,2097152 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,6249266855657009667,2907537348613939144,2097152 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5176,i,9997675404824642654,1311193224308519019,2097152 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3500,i,5055758026488832026,10807297128355951567,2097152 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,7936015846555083223,15119191296086983736,524288 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,8272932720175102535,3383232075035054393,524288 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,14474038861916576328,8715797689517003184,524288 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,14474038861916576328,8715797689517003184,524288 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3760,i,15794710034574276341,12837701475227344940,2097152 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,17402576129100950681,2456535571788900495,524288 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,6276409289368108225,1381425865789070132,524288 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,11192741502201304320,7713066746666153299,524288 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3080,i,16126372021009786368,4102751271003342394,2097152 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,17594094969391720238,14839136063160896353,524288 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=760,i,13958718043846444035,7467103913223450058,2097152 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5580,i,7492686393297626020,5555630247606565237,262144 --field-trial-handle=2288,i,206305032103721927,8510263453750194219,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 26dd1f3d0ab043de72fae51763871d83ab00be2991f140d635b1c9d6bafd6c11
MD5 8c5db2e8326b80eb6e689716e36b2f44
SHA1 947126db98c083bce94d4f10ef3ce102e691fc6c
SHA512 3e335be7f40c19bd365715d1326c12d5ce5ddb190807c27edc2173088dd69014914c583764798e142b00baf59f12df024db4eba0e0b58c7ea6074cfb29490335
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 03af416744dc6832209cc4a8f24f13af96cf30e1c0d9ec568957ef3722b57132
MD5 73265036dc4a4466afdf539bd79d8f83
SHA1 d14f8b934ab18064dfffba0669df3dea09d8ae05
SHA512 fa0536f1df41475aa3538e5eb1e2054273e5e9a23806a364521462acc6f503e885e6e06fe6eb3ecdac1470e895ef11b01176453e821568bad48785381af1aa10
TLSH
T12071E92B06C31859D7605632E4D142067A7EDC9DCF63BD66537C447EFA0ABE28CD64C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e068.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e068.TMP
Size 3KB
SHA256 3496d8b390bc5a3b9db85e4f9d78433680517ca58d8f47194ff08deed385e343
MD5 bbe189086b934867bb333af0eff47777
SHA1 d632085459e70d8ef2a1eb71f15f661bc090b7f9
SHA512 712c656403a22e35df4fa28b2cc64d803d931bda148bf4641e461d2c6687d3098e528b6d6ba9c31ead5d6b7fb30910e0123dbeb38f6e0ac93beeab47a10dc917
TLSH
T16F71E92B06C31459D7605632E4D14206797EDC9DCF63BD66537C44BEFA0ABE28CD64C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 0a29e3cd79fad0b658c93bf3b1af868c2b24f1f5f85c17a6a32447ed7b49450b
MD5 2d36b8cb81262c751a793aa613243f3a
SHA1 04dad87f3f8d9121a2c97d7145963bc290672a4c
SHA512 bf91374a57b1e9f765123934ea27e4d5540e5b424bf6d4b9114be64aa36ba7fd5fad0dfa7c96dd57fbefd8b5ae66447f5ae02a5d82ca4507f2922ec6f7e0a143
TLSH
T1DD019CB3C3E4996F8A0056F06A18AE2BCE2C0942431C7D6AC5D4BE2BA3F3475D10189B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c2dae1cf9231fa031b0ffa02d786aaddb2d0ff96e086e09e399aff59f2e330ee
MD5 e83988c9f818d1ec9a389643e247329c
SHA1 70339aaaed4c8beeae36b1d74159e776b8e392b6
SHA512 10558bb7573a02718822278cf1d47870293506b22541e10d83370909b39a7a3e76aa1b4050252348495409118af2f24914a57e9788d57ed182181bf0c716152d
SSDEEP 192:sxZeRoyM/jK1Ml8UQJk9/fZsXf+Idps2HUx6+WNGYwlrUeyIg51J:sxZeeqK9/fZsXfvXHRGT05
TLSH
T1EB52F955AA34A977CCDBD209FA41BF53D6F4447292910E44AAFCDA0C05E7AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8824777489fe68d913dd3c409bcaf62370c0deb6dacdcd9eee1956358c7c9fdb
MD5 8d8b8954af43c7cfdf9f2c6d922d8877
SHA1 afaaa96a8008501073fead4bd0ef0738b3b3bcb5
SHA512 c1885e1ec2c4954346063cdb6c424d7d203b94115ee7817ada0216e4545bf8c3acfd829a1d496f304f283e8e822f0533633e6412a11c37e6e26b64bae2c85480
SSDEEP 192:sxZeRoyM/jK1Ml8Mk9/fZsQU+IdpW2HUp6+WNGYwKfeyIgrJ:sxZeeM9/fZsQUvdHhGa9
TLSH
T14942E801AB34A97BCCDBD209FA41BF53D6F5447292900E54AAFCDA1C05E6AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0b670b57762542a1dd07dce1b745d53e8c94cae788db0d8fca6fbf104376147f
MD5 7b81bba8840fd11466307b75559ab2b0
SHA1 9b2a8b027e0bbc4523707deb55f2d462eb01f099
SHA512 dc443b3b7ecccc73ccba24fc6f74601ca7f7934b63d6ae8d00fe68c595a430e0e9767bd897db355cf253b420a784b729d458a4bd460196778decd245369ed0c3
SSDEEP 768:la4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dOroh+cuac:la4jeXmWvmKLEu1jacPLZQdFLa
TLSH
T1B5D20A3B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b6861a02e8f49a58fd081442bafcfb7f347ef8e9a08a4e5b592469bd0c49da89
MD5 adc1daaf185935afb3700a117e6c218a
SHA1 59e9ee7dd60b518baf9a2ae86f3b4efa9f9f9942
SHA512 bfff6c5db8d29028f3c64cfede788e77e2eb08f3cf88902968f4d8024cd6c177e87937e6ee6277d201d8be6730bb1375028abd7ec45419ff4c611374c4edb25d
SSDEEP 24:KdZ5fZUZ/ZmaZjdZLZHZv4Z/ZD+ZmIjZTZvKiZIhaZNZv1EZZZ/SmZRMZE8ZXZkN:Kk8IXKdOcfyl5IFKagI6AIPK5W8HyC
TLSH
T19F91421679BA52023C7F2A0C87A497978A437163350C646FBBEC01628E7AE214DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597c2b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597c2b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 4cc2e8b0c4857ec7fbc774bd2d17babf3f34de5a425a0d285c22b36a0da170fc
MD5 8868c5092eff77941b9d4452633bffba
SHA1 bd8bb54cb80cf3ce3c301c2b00d85e6d36f608c4
SHA512 51e45ea9a94661e11e2bd4ecdeb597ad494a3549d2103539fbca4cf4f08b1978aa62fe895525074d107a5d5f15bfc7d0bdac5012ddab682e8fb214f7d59c78d6
SSDEEP 384:ZiFiZcImzsNa8TUNTUlIla4YWc5mf+x82YEX26iF5f5UrzVWA:wFQWzwg4n262605SVWA
TLSH
T169A27C725CA8A83B6EE69A85F85A32138FF48167D6C57798E7DC6B1C009B1AC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0a7559ddf42a381af3503419a3d6a7b3d4f541b93691c42330e406256a82df01
MD5 7dd213dde10cb2b0de4010d69728897e
SHA1 290f7e0fd46dccc924e29e5d7cfe160b39c0c41a
SHA512 b48236eeab0c2bb8ece179d49debb8f4d5c5bba4bb85c812ebd9525fec1fbee1415ce8b1e729f55c0f3840c6a51b4d1febe7d9fcdb7a806115e6ea0c1b9c106d
SSDEEP 384:MZcIhsNCX4YWc5mf+x82YEX26cF5f5UrzVWA:ahZn2626a5SVWA
TLSH
T132927D716C78BC3A2AD2E545F85636134FF89127E7C52BC8D6ED6B2C009E5AD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6b7e7e738b7a07f6a0336e830803f97d8139a9d139854b654372236b01feae26
MD5 8a2a7855a47ee71a6f080a5802f7d2d8
SHA1 3103f6bf144ce6da3136bb1d5c7b8c9914a758eb
SHA512 a49c9bef81307641ae10ad383b8d8182062224815e1e9ad615d1e86cbd9e49fcc434df809392eaedfd29f0b02e0464d8428109c311f7f91bf07a4397c6af4514
SSDEEP 192:EONs6hZ0QmiUyJTpc/+jVLjzor2Yl5wOZXjU6:EONs6oWpu+x82Yk2TU6
TLSH
T16002D935A8787C778EE2AE46F48737235FE5112BAA956F84D6EC1B1C00C765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 70af6448311477f9dfa8db09add4cce57745342b62e0c3d6cc999bd3ec8bc26d
MD5 e2f5338b7187f6fe8a669e295e03bc66
SHA1 aa98c105615e309116e244b2578cd781a9fedd7f
SHA512 19829caaad9a3451d1545d19f974edc161c65bed4efbbdf828249dafa509a9752643e5d652145730718649bb8785062be374fc5e0123e8788a25b48dfd4279a9
SSDEEP 384:bZcIhsNCa4YWc5mf+x82YEX26cF5f5UrzVWA:Dhsn2626a5SVWA
TLSH
T14A927D716C78BC3A29D2E545F84636134FF89127E7C52BC8D6ED6B2C009E5AD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c56bf1af-129e-49fb-a813-4cbf7465d8fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c56bf1af-129e-49fb-a813-4cbf7465d8fc.tmp
Size 8KB
SHA256 ce7e36f25934cd1e433b76b6f2e75995915eca412e4458e1637be69a6e8a027c
MD5 b86a374f4b29791e2bf5c602f408090b
SHA1 ab5e6c75e9303f3e197a01da51e13e0bb158597a
SHA512 03a0811b770c95666f84fa056e6415830a00e6676957cdbe52a5ba67523766dbf225546ab07630f0afcab152b95499d2dce7fa98417f249a8af2c24502cd8aa1
SSDEEP 192:NONL6hZLQmiUyOTyc/+jVLjzor2YEXxEUmct5cOqRrq8U6:NONL6xPyu+x82YEX26Y95U6
TLSH
T11012E9326868BC6B5DD2A981F48736235FE55117EE897F94D6EC2B1C00DF6AC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e443530-01ec-41e6-aec3-7fd1ed0c25c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3e443530-01ec-41e6-aec3-7fd1ed0c25c4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 594ff20efdecb4017e0a68941bd4f699221a560313103ee917a6440cb228bd0f
MD5 c15898711716bd8d787b5940a62ec5ff
SHA1 33c50fdc95de77f6e673ded550d77abf00469ae0
SHA512 4d67261f75d02bc494499a177554a9c479aefe399651f3105992a80ca146a630565b898a4ad2b848c2593d1af69397586e04e1689c8175dc3dd6ebfb8079a05c
TLSH
T198411C68A6FE1148B3B76E5AABF6696D447EBC773E06845D00120D4F0A26A00CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download