hxxp://compassfinstrategies[.]com/

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://compassfinstrategies.com/
Sample260810-d6fcysam2w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2632	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308066326779197"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{3574420E-5380-45B4-B3E4-3908E7D580C3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 3308	3556	msedge.exe	85
PID 3556 wrote to memory of 2632	3556	msedge.exe	86
PID 3556 wrote to memory of 3456	3556	msedge.exe	87
PID 3556 wrote to memory of 3456	3556	msedge.exe	87
PID 3556 wrote to memory of 3456	3556	msedge.exe	87
PID 3556 wrote to memory of 3048	3556	msedge.exe	88
PID 3556 wrote to memory of 3048	3556	msedge.exe	88
PID 3556 wrote to memory of 1620	3556	msedge.exe	90
PID 3556 wrote to memory of 4124	3556	msedge.exe	91
PID 3556 wrote to memory of 1620	3556	msedge.exe	90
PID 3556 wrote to memory of 1620	3556	msedge.exe	90
PID 3556 wrote to memory of 4124	3556	msedge.exe	91
PID 3556 wrote to memory of 4124	3556	msedge.exe	91
PID 3556 wrote to memory of 1176	3556	msedge.exe	92
PID 3556 wrote to memory of 1176	3556	msedge.exe	92
PID 3556 wrote to memory of 1176	3556	msedge.exe	92
PID 3556 wrote to memory of 3988	3556	msedge.exe	93
PID 3556 wrote to memory of 3988	3556	msedge.exe	93
PID 3556 wrote to memory of 3988	3556	msedge.exe	93
PID 3556 wrote to memory of 2652	3556	msedge.exe	97
PID 3556 wrote to memory of 2652	3556	msedge.exe	97
PID 3556 wrote to memory of 2652	3556	msedge.exe	97
PID 3556 wrote to memory of 2320	3556	msedge.exe	99
PID 3556 wrote to memory of 2320	3556	msedge.exe	99
PID 3556 wrote to memory of 1048	3556	msedge.exe	98
PID 3556 wrote to memory of 1048	3556	msedge.exe	98
PID 3556 wrote to memory of 2992	3556	msedge.exe	100
PID 3556 wrote to memory of 2992	3556	msedge.exe	100
PID 3556 wrote to memory of 2992	3556	msedge.exe	100
PID 3556 wrote to memory of 4928	3556	msedge.exe	102
PID 3556 wrote to memory of 760	3556	msedge.exe	106
PID 3556 wrote to memory of 972	3556	msedge.exe	107
PID 3556 wrote to memory of 3004	3556	msedge.exe	108
PID 3556 wrote to memory of 1120	3556	msedge.exe	109
PID 3556 wrote to memory of 1120	3556	msedge.exe	109
PID 3556 wrote to memory of 3976	3556	msedge.exe	110
PID 3556 wrote to memory of 3976	3556	msedge.exe	110
PID 3556 wrote to memory of 3668	3556	msedge.exe	111
PID 3556 wrote to memory of 3668	3556	msedge.exe	111
PID 3556 wrote to memory of 3780	3556	msedge.exe	118
PID 3556 wrote to memory of 3780	3556	msedge.exe	118
PID 3556 wrote to memory of 4708	3556	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://compassfinstrategies.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x24c,0x7fff0ed9c188,0x7fff0ed9c194,0x7fff0ed9c1a0
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,5865137883232600393,4205765260346000186,524288 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,1815473814511057647,18166877857474588415,262144 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,13409224949959496979,9436692279345519852,524288 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,12923920287242911964,8752341429934834203,2097152 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,4508100390802195747,13216479469912255750,2097152 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,9000704074583256842,12064106687150561488,2097152 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,3888996688254444893,12144259957157016111,2097152 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4996,i,11789080133860773916,5787882827860712058,2097152 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,15635932952080618260,5052725851519755548,524288 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,17782971958404034274,9951483817096852912,524288 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5760,i,6431254057487891535,17190119774789902281,2097152 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,10569040911795698641,16996659291632508670,524288 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,10569040911795698641,16996659291632508670,524288 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,14155923416955915913,3779065801867542334,524288 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,9684579364683025595,4146776665715070591,524288 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,272857936588788387,7651191289474878949,524288 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3096,i,14075499220363457565,3611265121383242452,524288 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3080,i,16420632906121253484,15595384173902309188,524288 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,15317248111540979524,13998609400580850947,524288 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,7869062744797820125,558864925983014588,524288 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6284,i,11045383964909946026,16415504353645800157,262144 --field-trial-handle=2336,i,12557016670218464267,12874804693475211676,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 26374662fab280ef96eaa929fd16d9c29e3f74bff1e5cdf49f3940b212c74426
MD5 b3d937ce21fb8a9c36b91767a220b12b
SHA1 792049998f48955661735784aa1a6653cfd6d461
SHA512 05958eec7798844717209ca31b3321bd05988e5248f66df4ba666cf3bbad7c9d2a9fd23d375157547fdb301a268f9f7b0a6a6c7b7c9fa62856f0848ecb862773
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T190B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 14610fd2988408f995b800f46be883bb7036ce64dbdfe32072619d05d32f2bd9
MD5 915f6edc5864ba3e0ece608e84c76940
SHA1 52c5e5b5babd29a6c1efd45af7fed051c20d976a
SHA512 2ce27207e9315b41c33ad18ff11a0ec543629b3fce2302d89bdcfa57f464c096ff8419bab8fab00a0b31b137242669a3f44fa8c03e9e889033857df8c4683a0f
SSDEEP 192:Pj8B5QQQQQQQQQQQQQQQQQQQQQQQQQQQQQMyLO:Pj8B5QQQQQQQQQQQQQQQQQQQQQQQQQQ/
TLSH
T152E131DA42D8CB9BDF2612CB5DA4539C00B03749EBDCE90803EDCDDD344E49AE9A7690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 708244e4beef0b186568fcf40e2a4978c522fc936d38ab0d4ba04999efea7dab
MD5 3ca964bc794d0ed4e1dcd443613d8407
SHA1 c1e9d64c13522ffafe00972c2312a05ecf0d0d6b
SHA512 93da7cd490c9f7c1954d4b55cfbd6640bcf61b14c4aca6c36e183ef20604939cc117c9357beebefa8cb52332b5bf82d4ae1f778b4fc197bff66e1cf1e229437d
SSDEEP 192:KjpdSslnnwwwM+rrg99CCffZZ88HHKKttQMALO:KjpdSslnnwwwM+rrg99CCffZZ88HHKKr
TLSH
T122E159DB82D8DBDACF4511DB49A4529C45703709EBECE90803DDDDDD308E49EF8AA6A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d6a050a48e72a34e01780a36098a862019d63950f36f0da9fbe6be607d41abc4
MD5 500dbb120d7030e3e5c102ac8d8e09d0
SHA1 94fe5376ddedbaead6c9538fbda09d5d11c927a8
SHA512 a82025550bfd8a3ea5f3a30b98c61c516a97e52b98f91d4729715f432b84cafe76fd48b99ceb6c1d67a0c0e02c0e7c54a7823f0349601c7a9ff59a817029e38b
TLSH
T1827170B5066345C5F7210238F3F2B18476728454089FEE163947BFF865D67BAB114A1F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ca31.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ca31.TMP
Size 3KB
SHA256 0f73153f9c426924e31af6a7dc668f920971bff3ecf44030d384d27e6d07491e
MD5 adb4319a193439e5952154b09791b886
SHA1 ac5b1fac49a92bcf1c8baa765a65ce580c5d14c7
SHA512 54290517b70c75b5eb27f4eb9ebda1c73ed85c0bb00dce5b58694e70d8f320c1ced6bab2725cd0a661eed79bfc16a0be3ff0b3259c62e41ba3d49c1774152952
TLSH
T112615D79066305C4F3210238F3F1320075B24498089FEE1A38177FF465C1BBE6115A1F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 c6b4ffac21bc4d5ff069148ea219ae59b4a923712c8afc30d0fdae0e3fc5eac0
MD5 a585cbaff8f4ed8ad41e9d492bd88ae6
SHA1 0f7bba142c03db7d6f9b0933bb829ef0c0509320
SHA512 fff541ac31e340d75e1c4754483b19d55b8aa326cb1734e6676b7819a9fb59da944afaf4bd176b476aa7b9e871ee7d011f148017f6f4a18ad61ec371b3891019
SSDEEP 192:DlkD1GjNKVZ9Kgy1VZ6qjcW1Vd6GoZqetex9nST:DlkD1GjNKVZ9Kgy1j6qjcW1Vd6GoZqe3
TLSH
T15DE15AB287F4857CAA111DF4AB696F1BDE2F0925A2383D0A85F49F9FD392430E10195F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 23f8bc8eb5e874c8313d4fff1506d558afa548901c8358bb2867f267accad1e4
MD5 bbb4346bc2cc051312afc87e02dd5ff9
SHA1 71954293372f01d923a944f33d17e768bb0b03d9
SHA512 3e907c9712d9704ddf634b3edf52b486ea8b7d7d4b06944d30e9767bd34856e0715713f4b38f509fb693ae34024fb0e7058a32fa4abfc117f81df5049f0fdaf2
SSDEEP 192:sxZXRiyM/jK1Ml8MkD/f5sQ/0GjonIdp0OHW6+WNjDg/YHuggmIgrJ:sxZXoMD/f5sQMk7HHbw/c9
TLSH
T17B52E8116A386A77CCCBD209F955BF53D5F91572A2900E44A9FCDA1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3c5528ce8ae8b5200879c8b32740caa9b38381146a1a3084e5e7326ee7aa30ac
MD5 ee37389f45e4f6ef42685e1b9ed7ce59
SHA1 55e2c652d4498633b5f4c1fd42db9f864ba01396
SHA512 f1408426aeaed591e6a4744e79ff2aee7b4131680bbf2bf067ad23304e304675ceda00213a7dce41e84c7eabe80bd6b319c7b3e212ba476b48aca69e1dd45458
SSDEEP 192:sxZXRiyM/jK1Ml8UQYkD/f5s8/0SjonIdpSOHW6+WNjDg/YHaX0mIg5xJ:sxZXoq7D/f5s8Mw7lHbw/lN
TLSH
T15752E8166A385A77CCCFD609F955BF53D6F90573A2900E44A9FCDA1C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b5301b7549561921d2af62e746a77ccb6a7a1ce64299a9a3f040f78c829f68ea
MD5 b500bd3564c6dd7f2081dd094b38bfc4
SHA1 60cd2f3aaaffc17ae26614f0214bad4d5bd4166e
SHA512 148376112b31721e532558265244be22392ad9c75cb8ffda8f28b5a4ec06e3f329dc57f2aa37b563a32086855ef896faad5c5e81053be0be9d88bc761eeab321
SSDEEP 192:sxZXRiyM/jK1Ml8MkD/f5s8/0SjonIdp0OHW6+WNjDg/YHCcgmIg5xJ:sxZXoMD/f5s8Mw7HHbw/kN
TLSH
T10352E8116A385A77CCCFD609B945BF53D6F91573A2900E44AAFCDA1C04E6AED231382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 dfa8c030d2b5d30d6804775b9052e78256ce2f7eb1e4ef70d25cf0cc42ce0f1d
MD5 6c9660c7c32456dfe3174742f95e478f
SHA1 45d31960105cc6d29d08fa1c2812e668fcb70382
SHA512 61d87c02c7435fddd747a2474b2fdf03d633b85b076f85d96f41266eae7eda0835edbc11854cc35a67f0698e74707a30da19c0c94ba9076a31bd5edc8f0f8bc3
SSDEEP 768:MfUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RrroVT0u:MfUZYTMWvg0Pou1ja7eLZmRYau
TLSH
T1CAD20B2F280CCB7E4F844E9DEC266F967ED801CB5A584D5447EA894C03C76EB112B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 224aafbd03df6c1f9335571344bd6e0aaebb5bcbdf4a3a5dc0000286bb6694d6
MD5 125fac6b81a5297a8889107afdef7242
SHA1 8731bf3be7cf7186f1df42cbeea0222a31b07754
SHA512 91e38eaf78a3e5abbb2a8eee8942822c5d59c004f7abbf5b829e23ba49c97341d200a292d25c809949c942858126c38d989a710b11f80f2fb23fc0ce2719e175
SSDEEP 96:KA1eK2AEsIKZSi6cgKNiOvaKAsWje9+cK/qgz:E2PncJjey7
TLSH
T169E12B4670FA12023C7D2A188354976B8E92F1A3301CE96F7BAC55B14D66E249DFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3ff311e261a41607c27e65238bbe819cd8cb29a3610a98838d19608d5042720b
MD5 bea42df07fd7d1ab62e9b5500d03c979
SHA1 5057f891db34e25594effa6597037b95e02c7129
SHA512 63e3dab61718fc673710542eff49e70d9c7f60ad93f0d730aedc2e33fadc7b6df3cd8de6940e8bbf5b196e8743d46bf4b5ee35b1a88dced7efb06fd6ee4e037e
SSDEEP 384:nZcIhsNoip87Syo1zzX5od+08y91XMn6HlytEDq1fCUO:PhLcXOrMnoy6DqRO
TLSH
T145928D31997869779AEBB046F48A35034FF88127EBC42FD491ED6B2D00DE5A8131BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 56a36ae425bf704abcb5d1bb091cd812344539fbc86da2c440ddc6a0596329ba
MD5 543b9c68657032d5b4a7718e9274389a
SHA1 472d09b1362cd7d2f370cdb8d412685b40ec3d31
SHA512 3f1480bf4c39e5714c9d3bdd18bbe4987c503523858fce4c6214ad07c5177d9e8fe38e461c34af2365f4c69b83415577682bcc6652480e86893289f45fb10035
SSDEEP 384:1ZcIuzsNovp87SyoLzzX5od+08y91Xkn6HlytEDq1fCUO:NuC6XOrknoy6DqRO
TLSH
T13EC229F154E76836C9AEA343A77D2D024EBCC127B6841A94B3ED5B1CCC895BFD306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a152b00e58fd005ea2c54a47967bcd05021ceda75bcd8273f32dfa67a2c893a3
MD5 9fc88995c93087b4089cb0f5189abce5
SHA1 29e20e9abd3135123e3c19e06463731148b0bdd8
SHA512 31d78cd7619f4d51c8446cf395f2815ae0a6066bf96651505418d4dd169153eaae5599f1641b4666940e75f2858eb57f392aa15b728a30934d2d033847168886
SSDEEP 384:RZcIhsNovp87Syo1zzX5od+08y91XMn6HlytEDq1fCUO:5hCcXOrMnoy6DqRO
TLSH
T17C928D31987869779AEBB046F48A35034FF88137EBC42FD491ED6B2D00DE5A8131BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a6b5f0f9a8e5f5e59f18c2a181725477210c97c885396ab43fe9bb6751af4ab4
MD5 8c9c8a158b43eb5970d7157aa59c1566
SHA1 08feb0db656af52f30fbc8064c00c44a71479ee1
SHA512 ceb5e57a83e72bd46946643c6e7a7f121099b4dc16f76f6679a03ec79cdf0b44ec01165e2a369a941d9acc58f9f6b60d699d2e514dffa25f70401aac5e01e55a
SSDEEP 192:yONJ61VWQmiUyu3gGX5Obd+jIjzorynm2k/aw3oDLU6:yONJ6WngGX5od+08y9zjDLU6
TLSH
T1EE02D83568687CBB8EE2BE49B48737135FE82167EA552F84D6E81B1C00D769C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d42f783c64177df1f31d5ddb75c31d6e0ba4f6fde5e3f93133d8facfb44f69f2
MD5 9bdc46d18eaddb4f5344d0a1043853f0
SHA1 a0d8111e05c85e424c040778ffed27d26f5c2190
SHA512 b6af53e77ecca2f752644ed626f11cd3e955f12580446af0523effd9a71b82e22ab95a4286981fb2d52e4f29d7372ee5da2c720e5be8ca9705a624cbcbdf4df2
SSDEEP 192:dONB61kWQmiUyD3hGX5Obd+jIjzorynm21XaDGjJuqrU6:dONB6Z8hGX5od+08y91XNnU6
TLSH
T100120A32A468BC6B5DD2B545B08731139FE95267EB456F90D6EC2B2C00DF6AC131AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 76a6107cd1225f3b052646e5fe8f67a3160d97a4d1ef86519f077d75a507a08b
MD5 82ffd1e550e9883763a927f0fabba23b
SHA1 35a6ca5e2a5c562b481ba3f167f8fc5e453cfc06
SHA512 9d5b7c41facbeb0effd9c4012182c44c24eb80c7b9be341f84222be943385573c5a6520de64dcf5aa4ca55f18d2367de03d99a4788df537e45aea012e088bb3f
TLSH
T1C8411A58B6F91148B3B76F46ABF6B86E447FBD772E06909E00110D4F0A62A00C961733
MD5 SHA1 SHA512 TLSH

Submit Download