hxxps://epicunitscan[.]info

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://epicunitscan.info
Sample260810-nbbfmaff75

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2124	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308339862647740"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{DAAFDC8E-A8AA-4C16-A1DF-57AEBA25EB01}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 856	4940	msedge.exe	84
PID 4940 wrote to memory of 2124	4940	msedge.exe	85
PID 4940 wrote to memory of 5096	4940	msedge.exe	86
PID 4940 wrote to memory of 5096	4940	msedge.exe	86
PID 4940 wrote to memory of 5096	4940	msedge.exe	86
PID 4940 wrote to memory of 2304	4940	msedge.exe	87
PID 4940 wrote to memory of 2304	4940	msedge.exe	87
PID 4940 wrote to memory of 3432	4940	msedge.exe	88
PID 4940 wrote to memory of 3432	4940	msedge.exe	88
PID 4940 wrote to memory of 3432	4940	msedge.exe	88
PID 4940 wrote to memory of 4216	4940	msedge.exe	89
PID 4940 wrote to memory of 4216	4940	msedge.exe	89
PID 4940 wrote to memory of 4216	4940	msedge.exe	89
PID 4940 wrote to memory of 3392	4940	msedge.exe	91
PID 4940 wrote to memory of 3392	4940	msedge.exe	91
PID 4940 wrote to memory of 3392	4940	msedge.exe	91
PID 4940 wrote to memory of 1008	4940	msedge.exe	92
PID 4940 wrote to memory of 1008	4940	msedge.exe	92
PID 4940 wrote to memory of 1008	4940	msedge.exe	92
PID 4940 wrote to memory of 1224	4940	msedge.exe	93
PID 4940 wrote to memory of 1224	4940	msedge.exe	93
PID 4940 wrote to memory of 1224	4940	msedge.exe	93
PID 4940 wrote to memory of 464	4940	msedge.exe	97
PID 4940 wrote to memory of 464	4940	msedge.exe	97
PID 4940 wrote to memory of 464	4940	msedge.exe	97
PID 4940 wrote to memory of 1292	4940	msedge.exe	98
PID 4940 wrote to memory of 4604	4940	msedge.exe	99
PID 4940 wrote to memory of 1292	4940	msedge.exe	98
PID 4940 wrote to memory of 4604	4940	msedge.exe	99
PID 4940 wrote to memory of 4556	4940	msedge.exe	101
PID 4940 wrote to memory of 4072	4940	msedge.exe	102
PID 4940 wrote to memory of 4072	4940	msedge.exe	102
PID 4940 wrote to memory of 4072	4940	msedge.exe	102
PID 4940 wrote to memory of 4080	4940	msedge.exe	111
PID 4940 wrote to memory of 4844	4940	msedge.exe	112
PID 4940 wrote to memory of 3184	4940	msedge.exe	113
PID 4940 wrote to memory of 1412	4940	msedge.exe	114
PID 4940 wrote to memory of 1412	4940	msedge.exe	114
PID 4940 wrote to memory of 1412	4940	msedge.exe	114
PID 4940 wrote to memory of 4520	4940	msedge.exe	116
PID 4940 wrote to memory of 4520	4940	msedge.exe	116
PID 4940 wrote to memory of 2884	4940	msedge.exe	118
PID 4940 wrote to memory of 2884	4940	msedge.exe	118
PID 4940 wrote to memory of 2884	4940	msedge.exe	118
PID 4940 wrote to memory of 4568	4940	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://epicunitscan.info
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffe8ea5c188,0x7ffe8ea5c194,0x7ffe8ea5c1a0
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,10946977496223452549,7356064509132132716,524288 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,11965231255821072837,7902192961526732072,262144 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,15317764447213235944,720757118707705116,524288 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,5528935935963541483,8450506663463054175,2097152 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,13355708712373885271,2055338276448098571,2097152 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,8154385321913478319,5709710802771159815,2097152 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,14924435058805251595,4748638514571427688,2097152 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5044,i,4745287126698574490,11522424891133368818,2097152 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5292,i,10277041267047738096,15057016189464061574,2097152 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,15227178934364957050,13951477312713331752,524288 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,14456914014597594113,15828868997476805668,524288 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,17225697296185103352,5440584928611417337,524288 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,17225697296185103352,5440584928611417337,524288 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6160,i,16443081276840220107,16542906440117084755,2097152 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,3251913869059956660,1176350704054300966,524288 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,15021042869147070795,728548521114199064,524288 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,14954058804635589393,17668269178960275140,524288 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3312,i,2241637825536204757,12050387949143215498,2097152 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,6074308086180092739,4228552531669592816,524288 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5780,i,566443419696377419,16480879309638997822,2097152 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3048,i,4009806842689148672,13221736008783354740,262144 --field-trial-handle=2264,i,1338828715932592114,18258910356373508764,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bc9096622ad67087091ff7fca94be692d0b614dbde1b022f2749b66b510ae2b
MD5 e137387fedaeb97d0c9ff021c470ff72
SHA1 bbdd5a1b74596c7a2306e5e7596a61f913a74baf
SHA512 bf49f2e7d519b4d03a3fd2282183c9ada8b8a480e84c795b07597ec70c3c13cec2ee464023d21217dd48c95133d3a928268dad9581c005c11482df1f972fd052
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1FAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 730bd9f64d7f2b2c531719b70fe677370832412e1b911fd3810fc2b1785c2eff
MD5 0e02f18178c6d39d5d1daefe67c6399e
SHA1 f17df48157959ac3fc1fd4f03603f0f9bfbf4e00
SHA512 ee92cd462002ac953381b5c70e68d798101352dc59be2e9c075ac9d4d85902bddbe8bd7dbe27cb44430619bbd90336eee8b2c5c27a514d45daa88521025143c5
TLSH
T115612D3A028FC160F3A0C672A5D11D0E3A7F40970B4F9EA5D3B379FC951A7A595A384C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584d50.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584d50.TMP
Size 3KB
SHA256 47c0ca456069a34d8b60cc31d9fccb13e14a3b687651a581bb1a93749598c58c
MD5 8366239ca14a6803669fced718a65acc
SHA1 20d51b16d5aa3da5d75cfc0ff7415123c3cb81ec
SHA512 c3a5e945ed7f4ce4213e60f1f2b6680cf8be43c01afd307f5ee3ab6d67e8d4c56e91008a318b30a30464b915ed334442920b7c746d44f635cc62ef8ee261b0a7
TLSH
T139612D3A028FC160F3A0C672E5D11D0E3A7F40971B4F9EA5D3B339FC951A7A595A3448
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 bf62fb3861fc695639f9a6fae345f7f86b1d4f7ef7c4f57eeebd8aabd278cabc
MD5 5e50d98620e071a90d0d3b8d4872e43a
SHA1 51388ad636d64eedc11da3b2128476eae1703391
SHA512 92b882b4c0135410c3e7a1998afe4ae07d566b34ee5663b6e8e565eff5da4200bb54b18a9c569bf26e7712716f7d361223631202be717b0dabc858abe3423c38
TLSH
T121019CF3C3E4997ECA0052F06A18AE1BCE6C0906831C7C6AC5D4BE2B93E3475E00199B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 27478863e3c991d1884153f9af8a48b91d3ace6832f0a1010973642d4a5a3ca2
MD5 5f858eb132540824293efb159ed3946a
SHA1 43976524c2e06e167af087670e86e66eaf8cdf9a
SHA512 ba69e43ca09c22966d62787fcc7ba445cc2abf4b1044b8062ac9bb22e4dc9aafaa715b9499882f6730cdd963dfc8567385461c8d5a39dff4ef1d9d3bd9b28987
SSDEEP 192:sxZURTiyM/jK1Ml8MkL/fisgOclIdp1lLHW6+WNGYHjDJSbIgrJ:sxZUMML/fisgOcWzHbGL9
TLSH
T1BB42E8156A346977CCCFD209FA457F53D6F90873A2900E58A9FCDA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8a9b1c0ea494dc0fded816127adc32c8d6ddf0dd1a478a678562b8243b04bf23
MD5 2696b3759d0866530c92ff8b2a50927c
SHA1 8da9462e56896f88229a4567cd55fc51d2c52ca6
SHA512 a3c2c436cb201479a7936558ffdd77ed2b250e03e46555aa074f27061ce7c58ee5c69a2f6f0617f1ddb915a399d3f2ded8ae13c9e1c3756fd3df57be6334525d
SSDEEP 192:sxZURTiyM/jK1Ml8UQMkL/fisgO2lIdpjlLHW6+WNGYHTKoSbIg5yJ:sxZUMqXL/fisgO2WBHbG1k
TLSH
T10F52F9156A345977CCCFD209F541BF93D6F9087391900E58A9FCDA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d43808e2c003797de8dc29d61bf14daec236404b3560706a0d89d4d6774add7f
MD5 e0b8086f37a6cc2b40454a8d1e1676a5
SHA1 0649b6d54ca9d9390a44f7645ef1bbbae35c989b
SHA512 38a411330592f20b20f8c60827861ccdbb7665fce66c6c4e9ecade7b46379c3bcd48bdb65b70d92ef83a5f8eddbb7abe741ab32dd729ea7e928234066ee84718
SSDEEP 768:N4UZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RKroVp0g:N4UZYTMWvg0Pou1ja7eLZmRhIg
TLSH
T1B5D21A2F280CCB7E4F844E5DEC2A6F963ED801CB5A584D5447EA884C02CB7EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 584b47da61177148276f42dfd1ad21fd75ced35e5ef4c8938444fed391608fe3
MD5 8740e4b91fce4975a5a93369a2f0e78f
SHA1 413c58ab0bd3fbdfacc5153240713d7fcf0817bf
SHA512 fc86c029d7b22a080694af1625ca3e34c123824eb22459af88359050ee8c9cae9a7ac0d49f3507a18d8c7ea8e7d7dfd54c7910cbc609083c5ff2ab4ae456c279
SSDEEP 96:KA1eK2AYPOKQo+G1CKG0vLsfrZhR2ThC9Rr2KpTRd2tjLaNLnWNqK+0xz:Ect51j5M
TLSH
T1C9E1FA5270FA22013D7E3B0982A497675E46F163311CA96B7BAC10B54D2AE21DDFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88494790-bf96-4153-9cd7-b534e2bd9ed0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\88494790-bf96-4153-9cd7-b534e2bd9ed0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 619b599b21f5cdbf305f4466e9c67c911d706ec0157018cf31896847c95d7d1e
MD5 b13ab1e393ad98aa78bba1b768422a6e
SHA1 55298b6d3592da5de0614a4a12e28f4de158ee8f
SHA512 2da5a336d8c2a17bc06ba91d3be9cf441606a1c17b60c0cf982fcd6168fa8007fd58384bd6d0075918a3f5e0bd7f75040645a0d6ee22324eb8bcc47d295814c3
SSDEEP 384:VZcIhsNzxwrsejvzX5od+W8yLXTdQ6HlytEDq1MCU0:thDrJjOtTKoy6Dq60
TLSH
T1D6928D3594786C7799E7B545F48A35038EF84527E7C86FC892EC6B2C00CA5EC130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 b28766662b84fc7e9fd78e8d4f63b8b2b864ea129a2e61ff1379a0f0705876f1
MD5 91f091b3571fd2bdd4e93be74d751c48
SHA1 125da51748ab8dfbd3da65d7dcd05dd99f549241
SHA512 fd02408ebc26818b0d8e97c4a4a3a3bee278f846e98688b25c62de55fb87dc410d2c7360a4acfb2846deee4a8026274dd5ebdff0c02120b8ee64c5597868517f
SSDEEP 384:+iFiZcIQzsNN8TUNTUlIluwrsejvzX5od+W8yLXLdQ6HlytEDq1MCU0:VFQMYwgrrJjOtLKoy6Dq60
TLSH
T142A27E3244A8987B9DFBAA45F98A35038EF84577DAD4ABD4E3DC5B2C009B1DC130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e6cc62f054c1d7f640ce59b41b3bb837ef4f1bf016995fee62cbb883ee73352b
MD5 497f71b898076fd95ceae1e0a857fd22
SHA1 da723f25a8fadeb205ce0b5e888e564b0ccb1de9
SHA512 ad4dacc135aedaa8ce31cc2a7496818be17bf16daa630631ad24c90f6cbcecb1c9c75c4265775880587f837d504e3280643f47c183981eefc9a0aa4cb6dae2d0
SSDEEP 192:yON861VWQmiUyZ0gGX5Obd+j2jzoryXm0/aF3mDU6:yON86WTgGX5od+W8yUUDU6
TLSH
T1D102D935A8687CAB8EF2BE49B48737135F982167EA556F84D6E81B1C00D765C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 93bda564911231c69b300293709c68bf1865e169d432bd54c96410aa4d73d10f
MD5 454f40d7235c85383e290da4f5a92e2b
SHA1 a1a44eaedf9223acb1e0e8b7d66b36a2f02f1327
SHA512 8abda089bf15110527bcd87d69ec53d23cb0baccc799cf72f0e47d2f3dfa01622473e0ed7b43eebe2156c9547604c7c2879cd11efa92a9e92ad2a52736def971
SSDEEP 192:zONm61GWQmiUyXx0tGX5Obd+j2jzoryXmOXY7kjJbqkQU6:zONm67RtGX5od+W8yLXJdQU6
TLSH
T13112E836A468AC675DD2B545B48732139FA95267DB487FC0D2EC2B2C00DF59C231BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 356be7f4575c42a1211b84521979461a46ca879953dc32fa9a194d1dd731dfac
MD5 f95d71ca110feabfc63ecfcd33f9c490
SHA1 aa37c86dadda8460a71d2ffd772415ece8a15dd6
SHA512 9ea83cd0cede323ef251583b680abc67f3669aa1159c318fe780f5c5a155dce54e5f3c6c52ed442bc1f0e447eefb3975a0796c850e45cc883d8fdbfaff5ba47c
SSDEEP 384:rZcIhsNzuwrsejvzX5od+W8yLXTdQ6HlytEDq1MCU0:zhCrJjOtTKoy6Dq60
TLSH
T166928D3554786C7799E7B545F48A35039EF88927E7C86FC892EC6B2C00CA5ED130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e0749bdd5a626b73cbe8544584d241fcf3765e44e42af4e18773b28277906fba
MD5 04da239302dcde61d2c5c10cb8f7e2e4
SHA1 8d781e4fa932e03258f2966bef98f53bf3012437
SHA512 36c42c16e28829c0b46fc4ae3aba74c3d8b79faef60dfc936d1eb8b3b74fb3f2ccacf48114153680e1008e6a0c5fd9dfb0ae0772208e593706647dd9bdd46eab
TLSH
T15C412758F2ED1048B3B36B5AABF6696D447ABD772E06D45E10010E4F0A62F40C9A2733
MD5 SHA1 SHA512 TLSH

Submit Download