hxxp://www[.]finpro-auditing[.]elephantsmediagroup[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.finpro-auditing.elephantsmediagroup.com
Sample260807-s18vmsgk8s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2644	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305906108284277"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{6665EE0F-18D8-468D-8260-8ABC5602C107}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 5268	752	msedge.exe	86
PID 752 wrote to memory of 2644	752	msedge.exe	88
PID 752 wrote to memory of 6108	752	msedge.exe	89
PID 752 wrote to memory of 6108	752	msedge.exe	89
PID 752 wrote to memory of 1984	752	msedge.exe	90
PID 752 wrote to memory of 1984	752	msedge.exe	90
PID 752 wrote to memory of 1984	752	msedge.exe	90
PID 752 wrote to memory of 660	752	msedge.exe	91
PID 752 wrote to memory of 660	752	msedge.exe	91
PID 752 wrote to memory of 660	752	msedge.exe	91
PID 752 wrote to memory of 1316	752	msedge.exe	92
PID 752 wrote to memory of 1316	752	msedge.exe	92
PID 752 wrote to memory of 1316	752	msedge.exe	92
PID 752 wrote to memory of 3400	752	msedge.exe	93
PID 752 wrote to memory of 3400	752	msedge.exe	93
PID 752 wrote to memory of 3400	752	msedge.exe	93
PID 752 wrote to memory of 3584	752	msedge.exe	94
PID 752 wrote to memory of 3584	752	msedge.exe	94
PID 752 wrote to memory of 3584	752	msedge.exe	94
PID 752 wrote to memory of 3992	752	msedge.exe	98
PID 752 wrote to memory of 2956	752	msedge.exe	99
PID 752 wrote to memory of 3992	752	msedge.exe	98
PID 752 wrote to memory of 2956	752	msedge.exe	99
PID 752 wrote to memory of 3784	752	msedge.exe	102
PID 752 wrote to memory of 1004	752	msedge.exe	103
PID 752 wrote to memory of 1004	752	msedge.exe	103
PID 752 wrote to memory of 1004	752	msedge.exe	103
PID 752 wrote to memory of 4872	752	msedge.exe	104
PID 752 wrote to memory of 4872	752	msedge.exe	104
PID 752 wrote to memory of 4872	752	msedge.exe	104
PID 752 wrote to memory of 5640	752	msedge.exe	106
PID 752 wrote to memory of 5640	752	msedge.exe	106
PID 752 wrote to memory of 5640	752	msedge.exe	106
PID 752 wrote to memory of 1904	752	msedge.exe	109
PID 752 wrote to memory of 6044	752	msedge.exe	110
PID 752 wrote to memory of 3436	752	msedge.exe	111
PID 752 wrote to memory of 1512	752	msedge.exe	112
PID 752 wrote to memory of 1512	752	msedge.exe	112
PID 752 wrote to memory of 1512	752	msedge.exe	112
PID 752 wrote to memory of 4680	752	msedge.exe	116
PID 752 wrote to memory of 4680	752	msedge.exe	116
PID 752 wrote to memory of 2320	752	msedge.exe	120
PID 752 wrote to memory of 2320	752	msedge.exe	120
PID 752 wrote to memory of 1560	752	msedge.exe	121
PID 752 wrote to memory of 4536	752	msedge.exe	122
PID 752 wrote to memory of 4536	752	msedge.exe	122
PID 752 wrote to memory of 4536	752	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.finpro-auditing.elephantsmediagroup.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff4709c188,0x7fff4709c194,0x7fff4709c1a0
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,8408485629552595981,1090882225014463121,524288 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,2503113132646713198,17273853459437773723,524288 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,16469362836415914722,3650425338902421729,262144 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,4004863868922466361,12975089857062918896,2097152 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,5164142399407950015,10048928202519442792,2097152 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,10462021529504053558,8997293102020898657,2097152 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,10148474785584103899,14074752762894922196,2097152 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,8354334171599951120,14514580476500230365,524288 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,9168558243627336222,892525325643967641,524288 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,6647389868213449024,2111639625742191095,524288 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,6647389868213449024,2111639625742191095,524288 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6224,i,16606593068029153108,7228769135935621822,2097152 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3512,i,2427693287869419814,17417940574879133908,2097152 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5892,i,17302387676440385369,5882633467732641426,2097152 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,11236138509605953194,14867363226755480622,524288 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,15798903257018712264,14576207924550143210,524288 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,16170100313124880229,15640778054833650964,524288 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=1684,i,15155346916599602549,1721133893080600388,2097152 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,18155967208090666050,1575552659375136588,524288 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=764,i,14529694641121795296,742336894781523871,524288 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5216,i,12125872002885911354,3421759205130291147,262144 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6156,i,6285899964043110680,16886952788317449069,2097152 --field-trial-handle=2256,i,6904027458095340976,10518869344191140192,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f215ed8d49dc2299bb39f3fed6b23ac7a6ac6d095bf8f994db995ac13d671cd1
MD5 1e1076264bc3b2fc530c40c7a640d1b4
SHA1 3f4a2e29555bc832cefd02f1b92a982b23175099
SHA512 4cf7ad60718a21c5c8e87c0d45f2e2a5af6939a7f897a4bae9dbde65602b6f22d232573af0662fbe07afd3fe075141f7e0ef64806b4729f150592e4be4227e25
TLSH
T116612B1836CE003EE7538EB9E1EBD6013FF191B47A0B8E41E6C4F87DA925F354464804
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593ec4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593ec4.TMP
Size 3KB
SHA256 5210b7c12b1fbb97f5c74931c27839505b1a3439cf1720ce919faa07dbeb4091
MD5 c5fa800d886607bd53b86cb4f6012b32
SHA1 720b06f35a358312c986bf0e2764fb66c445d79b
SHA512 dea42806f70683150fc4d40bdd0bdf037f972ef5fbfb05e42bd691be3c9e1937fc05561c9f81cca1e31b49d604a441f4867ebfeb4c75918c82075c97b1ae42ed
TLSH
T127613C1836CE007DE7538EB9E1EBD2013FF191B47A4B9E02E6C4F87D9925F314864804
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 da3377d64fb6387eb7a16fc09130c68bc964ee7e60c82fca6a8b197dc521921f
MD5 8fcf30dc5d3234c554c6986cdd3a0a06
SHA1 89a4a2756d1d71d0a93bd2652f4a5e00d6d5c1bb
SHA512 e9923c64d72b6bd5565d9b4b70222f2029f989973a540805ccfbd6e0007d519289ae4afa96a5d17984f9ef29c3603b2c95bfd5e4378e0ea3bdaf9413a3828ed6
TLSH
T1D611BAF3C3D5856E890156F06A28AE2BCE2C0A06421C3C69CAD4FF2B93E3075E00255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d78f21ccd456582ec85f5c18481641886942d4bf6cdb71ff3b09255c038259ff
MD5 c8910abcb5b1ac88334ec4db3e6a96a2
SHA1 45574cf41b7903907e3978d833ee9e83d15e37a3
SHA512 676fb11916bbd7e9bd0cb693d8db6cf54666d568d9b1263dabb9f11086856e32385a19291f9176ad08fdb2dea517c10648b51dd1804660fa42cee52e4afc6c37
SSDEEP 192:sxZDR7kp/fosdNg/IdpmSH79O6+WNGYwKLr4IgrJ:sxZD+p/fosPgwBHdGz9
TLSH
T16E22B7526E38A57B8CCBD219FB25BB13D6F5503291901E94EAFC9A1C05E7ADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 90866e28a319e242a6420a17247aa3e62f746fc1738dd9f312765e8db3c9d56f
MD5 ee5a42b0dafdd1ecce3617c99aa92d5f
SHA1 ac5f9cad6adae0fd19972578f822a1ddb4cda12c
SHA512 ef97d9b5f75f0b47df46db292758a23fdefa6dcfcbeb0a606487127477f460ac4781de7e954cdaa07eb711015a1753700fd753a1fadd2f6d49b660f42eed19d8
SSDEEP 192:sxZDR7kp/fosqNg/IdpmSH786+WNGYwKLr4Ig5IJ:sxZD+p/fos+gwBHpGzG
TLSH
T1B922B7526E38A97B8CCBD219FB15BB13D6F9503291901E94EAFC9A1C05E7ADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d92b471c8ee1f6ef116f5ceef38e9852e3888fb7c72b72098787978c01de94e6
MD5 3fe282deb2359caa6d1422ff070db0bd
SHA1 049750c6f7dbdeeef779fc1a5e592327781bfa10
SHA512 0b4db98d640190fbc6ed02a8e0aa8b424ea929a79f70db97d7c23073de33605d98ae5df022a2bb2a55592d1f1dce104c85f165e27287376e0d43e0a7b1f67885
SSDEEP 192:sxZDR7kp/fosqNB/IdpmSH786+WNGYwDzr4Ig5qJ:sxZD+p/fos+BwBHpGSE
TLSH
T18922A6526E38A97B8CCBD219FB15BF13E6F5503291901E94AAFCDA1C05E7ADD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 327aca775e5f2f9c7695278fd295c6866734bdbab9f5758c3a59b0455630866b
MD5 1adfd2c164174e5f2bd034a74413a0cf
SHA1 a451c53f8c881c426cf2f33e03dca8aa23f62b40
SHA512 0431f18fcbe67e07e07ab12fe8be03931d2eaa4743edb4e4433dd74fb8e90ceb98abe03479fb1da63f5cbff87fb921d3553473f32c72cbb644972d1758f60b56
SSDEEP 768:tPmjYDmWvmKyE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBPLlrZ+DWrofjUaI:tPmjYDmWvmKyEu1jakPLZQDtLY
TLSH
T1E9C2EA3B244CCF7E4FC01A9DDD5A6F973EA802C76A588D4087FA954C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 609B
SHA256 d176cefdfe6a95e39a82fde008d1c944f09cfdb9b72a94613c0ef61fad8491e1
MD5 8e16fd2da9bc3a85265581acdb595d10
SHA1 9e0f32f1ee813a6ed5715b5b0347581e6c630434
SHA512 345fe90d35ccfff20614d7144c7b2379ae5a9bd9442be084ac924d68c284b55ca963ed5f7772d057597f8adac88e875542c344b4ef360cf1617076f18536fb55
TLSH
T1E9F06B2030ED03902CFF6D6C8C55C916525239963B1CA42EB6A480558DDBE330BE8CDD
MD5 SHA1 SHA512 TLSH

Submit Download

08b99c20-8d64-42b1-9573-da5674a1f7c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\08b99c20-8d64-42b1-9573-da5674a1f7c9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 1e0300e98a8f6fa54bcd86c2ef19e780ca59baab42b0f2f9af893a24d06d08f8
MD5 fbd1df70ec2bbef442cf68c5725ebe23
SHA1 d26743aeee438da46ccb2c4491ef0d85353552a9
SHA512 6f26eb106a6066e40c2c7f69bdd10e2fc500baa3935b69a2047408361beb415e74952a508f874f21be9f9a8616f653929bf7fdc394665cd9f8ae2412bda03f46
SSDEEP 384:isN792jSEhQZf+k82EXH+2RFOf5UrzRKDjI:iqhIHlrOSRWI
TLSH
T161724B356878AD3659D2E685F04B32139FF84167DAC53BD8EAEC2F2D00CF5AD2706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 94564967435b4cff972069362f0afb6e02a0896222b638a4d2fd1f9b8043aad3
MD5 6d9b9e34a80d86d5073eaed9f81dcfb9
SHA1 dd2739f80ee013e3220369a874ff0a4f2d7a37bb
SHA512 8fd982deefb7d6395d48ff1a47761edab4b42cc18df7c3e803810242b09b32c5ed40821812056bc3d016a0c980545bc6da8af7a5aa8462f1011156d7a0c973ae
SSDEEP 384:OiFiZcIDzsNF8TUNTUlIlH2jSEhQZf+k82EXH+2tFOf5UrzRKDW:lFQHgwglhIHlHOSRZ
TLSH
T178A26C725C68D93AAEE2DA85F54A32138EF88067D6C567D4E7EC6F2D009B5AC1307812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f8b925eaf01491e3ba3775ab9b930cdba61354db38d7bbe0af4bd8521901e247
MD5 a78cb7de39cd31d28d3dc01c3be497d6
SHA1 1bf42c46d8d47275b1663f7cd5ada3816d9a5c87
SHA512 dbc5297a61c7a6c4284202702a09c0ac84dc17c33c435c070ea74af152d35d4bcd3f358868d601a4388b02941e44e2494faa9b1690966624fbba1c8e2bab5c7e
SSDEEP 192:EONq6hZ0QmiUym7pc/+jVWjzor2tn5wOZWRU6:EONq6ohpu+k82A2+U6
TLSH
T17702D835A8786C7B8EE2AE45F48727235FE5116BE9956B84DAE81F1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e17d4237fca1099bf46170fa9cfb1ab9e35ed52765497273493f658e7c7100f7
MD5 96406800d4fcccd68be417d398d76389
SHA1 8a137902089bdb042c09f99838dfb466a22546a8
SHA512 8f3c7f2a8c163364cb196852d396944be27f36540ce81879310b551e51d177e6f709a52467c649dec15290482473943da15b9bdf0bf7f88c76643c65f434b911
SSDEEP 384:hZcIhsN7H2jSEhQZf+k82EXH+2RFOf5UrzRKDW:phWhIHlrOSRZ
TLSH
T12C928E715C78AD3A59E2E945F44732138FF89027E7C53BC8E6EC6F2D009A9AD2707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4e72101a37e19d49a02d96a3ecc5c5f7dd957f133511c373009a3eba0af19145
MD5 16d84f0f7f4c155028fd93e29b7615ca
SHA1 35f95bff50ddb7e65c07215f7f971db56bd0a628
SHA512 eaebd2c1cd0d3f47176bfcdae80980a7207cb7c15bbdb9bb187f6b97a78ba29f5d874eca85699c17574deb68eca68b31d895541e50dfbe408de754343d8faf78
SSDEEP 192:JONG6hZXQmiUyI7bc/+jVWjzor2t+XH+2u5cOq3qFU6:JONG6NRbu+k82EXH+2B9OU6
TLSH
T1E212EB366868AC6B4DD2A955F48732234EE55117DEC97BD0D6EC2F1C00DB6AC230B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc264457-b8a8-4e3c-9ae0-587c7b1c235f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fc264457-b8a8-4e3c-9ae0-587c7b1c235f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 73777693a66c25c63a91ed98ee0b64609011dc9337a4558192f6abc7720b51e8
MD5 bb7681f49f5f8cc261919708400670b7
SHA1 c44dfdfb1e65bfc172641efbfd8060ef7ac31aa0
SHA512 5d4edbbf1555bbcbcf2f3fbff7f8da2bfbd9ee1e07611be7205c339b0f708f3708aecae484c5d405e11d53b0a3909ecbb1bcf69ca1bd0036f8924c312cc57d35
TLSH
T17D412758B6F91108B3B36E5AABF6A8AE887EBD732E07945D10110E4E0962F00CC71737
MD5 SHA1 SHA512 TLSH

Submit Download