hxxps://account[.]teamviewer[.]com/link/authorizedevice?token=BQ4BBAAAAD3I2xMCBAAAADETAAAEAgAAAFNWBQ8AAAAyMDI2MDgxMFQyMTIzMTIGAgAAAGVuBxAAAABhGw3zCJc-IP3JLqrxruGOCEAAAACjHEX5seup_nF9Xs0xikscIbtzTwDmJ4f1cqpSn-om7nX66LaTYd5Y2DEMNXXedRZveite8gbU2cJx40yNUJnuCQ4AAABTYW11ZWwgU2FsYXphcgoMAAAAAQIDBAUGBwkLDA0KCxAAAAD5DBFXwj2mSpPKD

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://account.teamviewer.com/link/authorizedevice?token=BQ4BBAAAAD3I2xMCBAAAADETAAAEAgAAAFNWBQ8AAAAyMDI2MDgxMFQyMTIzMTIGAgAAAGVuBxAAAABhGw3zCJc-IP3JLqrxruGOCEAAAACjHEX5seup_nF9Xs0xikscIbtzTwDmJ4f1cqpSn-om7nX66LaTYd5Y2DEMNXXedRZveite8gbU2cJx40yNUJnuCQ4AAABTYW11ZWwgU2FsYXphcgoMAAAAAQIDBAUGBwkLDA0KCxAAAAD5DBFXwj2mSpPKD
Sample260812-rexd2sydpc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2520	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310172308842100"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{161E5C00-32D7-4BA9-8B55-9B5E29080E16}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 4660	2416	msedge.exe	86
PID 2416 wrote to memory of 2520	2416	msedge.exe	87
PID 2416 wrote to memory of 3264	2416	msedge.exe	88
PID 2416 wrote to memory of 3264	2416	msedge.exe	88
PID 2416 wrote to memory of 3264	2416	msedge.exe	88
PID 2416 wrote to memory of 2244	2416	msedge.exe	90
PID 2416 wrote to memory of 2244	2416	msedge.exe	90
PID 2416 wrote to memory of 3000	2416	msedge.exe	91
PID 2416 wrote to memory of 3000	2416	msedge.exe	91
PID 2416 wrote to memory of 728	2416	msedge.exe	92
PID 2416 wrote to memory of 3000	2416	msedge.exe	91
PID 2416 wrote to memory of 728	2416	msedge.exe	92
PID 2416 wrote to memory of 728	2416	msedge.exe	92
PID 2416 wrote to memory of 1820	2416	msedge.exe	93
PID 2416 wrote to memory of 1820	2416	msedge.exe	93
PID 2416 wrote to memory of 1820	2416	msedge.exe	93
PID 2416 wrote to memory of 4068	2416	msedge.exe	94
PID 2416 wrote to memory of 4068	2416	msedge.exe	94
PID 2416 wrote to memory of 4068	2416	msedge.exe	94
PID 2416 wrote to memory of 4236	2416	msedge.exe	96
PID 2416 wrote to memory of 4236	2416	msedge.exe	96
PID 2416 wrote to memory of 4236	2416	msedge.exe	96
PID 2416 wrote to memory of 4832	2416	msedge.exe	102
PID 2416 wrote to memory of 2916	2416	msedge.exe	103
PID 2416 wrote to memory of 4832	2416	msedge.exe	102
PID 2416 wrote to memory of 2916	2416	msedge.exe	103
PID 2416 wrote to memory of 1096	2416	msedge.exe	105
PID 2416 wrote to memory of 4156	2416	msedge.exe	113
PID 2416 wrote to memory of 3740	2416	msedge.exe	114
PID 2416 wrote to memory of 3192	2416	msedge.exe	115
PID 2416 wrote to memory of 2796	2416	msedge.exe	119
PID 2416 wrote to memory of 2796	2416	msedge.exe	119
PID 2416 wrote to memory of 2388	2416	msedge.exe	125
PID 2416 wrote to memory of 2388	2416	msedge.exe	125
PID 2416 wrote to memory of 2404	2416	msedge.exe	126
PID 2416 wrote to memory of 2404	2416	msedge.exe	126
PID 2416 wrote to memory of 2204	2416	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://account.teamviewer.com/link/authorizedevice?token=BQ4BBAAAAD3I2xMCBAAAADETAAAEAgAAAFNWBQ8AAAAyMDI2MDgxMFQyMTIzMTIGAgAAAGVuBxAAAABhGw3zCJc-IP3JLqrxruGOCEAAAACjHEX5seup_nF9Xs0xikscIbtzTwDmJ4f1cqpSn-om7nX66LaTYd5Y2DEMNXXedRZveite8gbU2cJx40yNUJnuCQ4AAABTYW11ZWwgU2FsYXphcgoMAAAAAQIDBAUGBwkLDA0KCxAAAAD5DBFXwj2mSpPKD
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffa6214c188,0x7ffa6214c194,0x7ffa6214c1a0
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,9165923640259893327,13292916354672355522,524288 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,3943589263604328140,18087119461950218440,262144 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,6425735986020448244,7998943102359314662,524288 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,1382736078385044539,412125782160714026,2097152 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,18139849947652012954,1666097212730147830,2097152 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,17550388246700399927,17720972391019189877,2097152 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,12081838649714695526,3091489264596395197,2097152 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3608,i,9453019149610541363,4085236103282709606,2097152 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,13877845182458123484,17483452422795187948,524288 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,15133041678922711339,8963701649284687485,524288 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,13133322129552065001,5731398357474759877,524288 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,13133322129552065001,5731398357474759877,524288 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,10428132951043781095,13564767571011678032,524288 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,14271072166509123750,14830690558797756743,524288 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,6605254517849614013,18252592229731228816,524288 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,4775333712953079126,9248373283815076876,524288 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,16053019552726411139,14944808107723200832,524288 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,3535362331526807148,6337255239393772277,524288 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5940,i,10504461014599757780,6072122303227767539,262144 --field-trial-handle=2308,i,17686190936705394938,8325395104751343478,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a129eafd4b0f75f4a77f8f369d7625aef5731ef02970010277657f6b7dd42499
MD5 44c5afcab040cb6afa997e0b4f0f3fff
SHA1 331f9ce5de9e2a264eb6d5ce878faa562ab1e7f6
SHA512 c579d2e13ec6ea135d002840d7e2868cf77056bb3d591cc3c9522764d40093fc690ee1b936033150d31537c67885a901b539ce687069bf67ca514f8df29b63a4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
TLSH
T13FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 deea04b3d3f0c5fb325dc2e9bfd98a7c8530b6ba540e9129b79329c05b3937bb
MD5 d7c1866c9e6140607871fcb751e24004
SHA1 4f221de745e871fa59ddade13b04af8d46324bf3
SHA512 b23c07e118d319ab020410dee1c4b901d7b11154d6779bd8fca379963e4e2767ccd0a040d34500120d108ff4a10697695ec7f744f953fa8d135ec771e07594fd
TLSH
T16CE0264A1280CDA88D47F747B06B639B6070F12FD7CCE89A374E7A94248CC07EAD7080
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 06cb76e5cded7563c9cd45abbb6d2e499901293f0fdeac469e5c05ffebb92af9
MD5 af4b864f61f2e157a349bc05c61c3544
SHA1 beb07a7858caf61fca007036de72e71891e60bda
SHA512 d4a47fe3a69cefdc42beb1b19ad86f6e3866385313268d8c157439e3634bfbb78690fa219fedd0db133cc3e11da171cae058cfe794db29b03df7b70e655fc289
TLSH
T1B1716FB0140EB899E35E01389CC25E0C7F7140E9F417BF7D1A508F71551DB2881FAB26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ae1d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ae1d.TMP
Size 3KB
SHA256 c17f49d0786d46180faff1df9eb782c69ab35e978bd025fc21c32e12b43c7cc9
MD5 b08e5769fbb9712c2a0cc519805fe24a
SHA1 e57f2a138309562f51a755994e745fca1e8120fd
SHA512 ecbdaf234e387dddc5ec0676145b34fd5c974be40834bdefc00691d23ff971d33b1c3941d5ce2661fce9c8b1f0eb83a375aa9038eabb60bc7892fb64093107d3
TLSH
T16D715FB0150EB899E35E01389CD25E0D7F3140E9F8177F7D1A508F75551D72981FAB26
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4726cffb735f1dd1bc1322c1bda4f34e3ff354d82861bced990de6e7728c0d9c
MD5 a81822e3f9fae33208d45f85af7b1cc9
SHA1 aa1e74f22407d5036269c29099c1e847f74c8f44
SHA512 f29b115f75f1f2470ba84c37bc21370fa58959cecdf36dec41f4d6f8afd491aadfcdb3519ba34ca763d4b5804e7471b3a4c3e554844f9baa1b2da434bd041229
TLSH
T18021AFF3C3D4862ECD1266F05A24AF2BDE2D094982283C2AC9D4EF5797E2471E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f712da0bb9008a925d528084b73728421d82bbd5a04f48037b92debff949c560
MD5 bc2867e42ae4fa94c604833581d097f2
SHA1 f0914f4b83189b3a19d8ea638b5918be8486acaa
SHA512 a623ae4a1b742eabaf622bf40cece0502a23594bdb18e5a81bf07c7193e47ddc1103ea663a7db2eca90f3632858f795e122ed87cdcb280ac5b2aa97158c37e62
SSDEEP 192:sxZZR9yM/jK1Ml8MkG/f4sC9w6XIdp4ywHW6+WNFhl7/YzpireIgrJ:sxZZrMG/f4sC9w94HHbFz/a9
TLSH
T1EF42E816AA34A977CCCBD209FA55BF53D7F50462D2900E44ADFC8A1C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c41a3fa1acbec0ee2709858dc73a3ad39e67bc21423901af7c68cefb3c3bcf1a
MD5 b7edb39aa7d1c9659e1169b657511b4c
SHA1 cb7e2a22c4f336356f72b89acd9cf00726873da2
SHA512 2245743908e600f6ed9696b7696fcce87d5b38d623b59008c92aa03e85c9be8cc74cc5682f8525f6f29d300b70a0423af1560bf31e2380fde2d21a6ed49f64db
SSDEEP 192:sxZZR9yM/jK1Ml8UQfkG/f4s99w6XIdpGywHW6+WNFhl7/YzYyxreIg5FJ:sxZZrqMG/f4s99w9GHHbFz/FF
TLSH
T17652E8566A34A977CCDBE209B951BF53D7F5046291900E44AEFCCA1C01E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c4dc9f9e676cf04120eb1af108af3bb1ebcdbc5d8fb909dd3692469fa1317947
MD5 c67c18ed1df71cb2a1b3047dc9a03fbd
SHA1 74f83b7dd479aeb4d2b41762f23376b138677c86
SHA512 642ae50ca9a1b2ea375f62f90f3a942c8c55227dca2438827386ffedba3478e1b7b250f2c38cd052f93c5400172418bd8e7ea5f12d1221a3e61e30031e57e78d
SSDEEP 768:cnW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjXroIs2ikYD:cnW7kf0Wvqidau1jaa5LA3jEVD
TLSH
T1D9D20B3B684CCB7E4F840E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 18aa890ae3ccc0252d16155e34435816f34170e7d54ea55aa4e24b3d62a00870
MD5 3f4e2baa1623727aaa5fdb073ef531ae
SHA1 9a8455afe3ae127f089fffcdf54a2839188c97e9
SHA512 318282d07fc3f721dfbcc334e0265b96b828039d4f332ca86a34732b3f31951eb85c67307232f258579297437f43738adfe8f388af42adb67aab129ca55c5f60
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYT73sbnR9JkZ9uPIufkKjB7pkPH08ORH5yljIBKIwEojt:KIbCKcrUAKdamuj6KIwPjOKo8l
TLSH
T19C913716363B0A113CBE3889A2968A375F4231633014B4AF7FB8107A5D6BE214DFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adb51623-ef38-4fce-9700-57f0df96ce68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\adb51623-ef38-4fce-9700-57f0df96ce68.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5949f0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5949f0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c536ab4ac1296170afc521db35ada116df3dadc4a78891a386fc3185618df6dd
MD5 3059ed87ef40e2af312ae87f1f4746a4
SHA1 0b7c00f553547f4c279a9f72c992388ac1e08adf
SHA512 7c8d20bf15b79fe10520b8ae189a083787d93c7a5765271b9e11f4e3779da59b3b95872b751a70927d9cf2a563e88b1439a6148713d7aa5d5f6dea2df5cab4c6
SSDEEP 192:uZLsNNjQYByfXdBbRuQmiU1TsN4aGBPKb++FdG24RFC1SJroedNmquVU8:csNNjbByDbgyCSd3UCEJrzCVU8
TLSH
T19E321A356C74AC3B5EA2B541F4473A13AFE8412BAAC52F44E7ED5B1C01DB69C231AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c2a08e5144aff69d6a3ccc3fbef2fcf0c3266661daf8f3199c2c980b19279821
MD5 29365d0081a60dbf8c92a3bd5101513d
SHA1 23969448bff48787618c1a9458c1d2e6af420f87
SHA512 e2b9936821cb43a982659e8b4a527cd63545302ba372aeee42476581eef5ab311c99de81bca00f99c3bab4a500827890969574b499e3e5a3bdcfa05e091ff0f1
SSDEEP 384:viFiZcI6sNX8TUNTUlIldbByDbgHCSd3UCEJrECVMsRnlYej:6FQ6CwgHBCWRYhECVhn2ej
TLSH
T1F0D24AF288E3553AE9AE5B43E77D2D029EBCC067B5815944B7C89A0CCD561BFC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 405152c1b59f2732c021a67c665217e34d6e0581dbefdbfc796c1f8ef9e4c1a6
MD5 51bd47e45dc0828413d4a12e336fbbce
SHA1 6b851ba0ef471a98e2ed4f3299eaf3993a4f4795
SHA512 7a6799afd5a2aa28b4ab0911db22bf7c17ec5b364a40948271d06fbb55db1c72debd8d35725f04b7214e670fb0e385bdda1d1121be599ae42f20c1d9bd692a6a
SSDEEP 384:3ZcIhsNNdbByDbgyCSd3UCEJrzCVMsRnlYej:/hUBCnRYhzCVhn2ej
TLSH
T1EF929E729C742D376DB6B543F4863A039FF8803BA6C56E44FAEDEB1C019A6D81316C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1e5253eb86f2be6ae48d0d28e1f754a139a7b65ba91baaf9039ad197f6276b5f
MD5 0c635d6489a0c7452c9119ede8f3c3b9
SHA1 57c098f2595ec789f93f2d8bfb98164c14b050da
SHA512 0fddb42ea28b121f333915e491f3133502719c2a24f69126d0fe4fb8a16936987f40399f750d8ed70e2412609df116043d4be921e3dcf145d25626480496de43
SSDEEP 192:MONi64BAQmiUy21fW5GBPKb++FdG2MaDbtWU6:MONi6eARFWNd39RWU6
TLSH
T11602FA39AC786C7B9EB2AE45F4863B175FD8103BE6C45B44EAE85B1C009774C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c69a258c28ad511f29e80de0228d6322bdf6b775bfa4c470036e7c778f64852d
MD5 4cefc4aaee46517824745b4135603449
SHA1 2e2186db0766c041f7bd864888ebaa7829c7c9fa
SHA512 b4340b09820da811ec736e8492e644c67d348ba5daa74a77ef28112db087ea464700f508c723795ca69fa88e9a68d3912eb7bedc5936bf0f3030697d4a53d39a
SSDEEP 192:/ONA64B3QmiUyofe5GBPKb++FdG24RFC1SJro/WwmquVU6:/ONA6eZJeNd3UCEJroCVU6
TLSH
T1DA122B35AC64AC3B5DA2B541F4873A139FE8413BEAC56B44F6ED6B1C01EF69C2306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e41711cc-b4cb-49b6-bcfb-e3ca300adcd9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e41711cc-b4cb-49b6-bcfb-e3ca300adcd9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 484f585e24305e50e790b7816e4bddb8d3a1d50d139774809e200ec4da7918b6
MD5 d26eaf630cf0cd8110b8325db3766706
SHA1 5f409cf32bbebcde14317f9cd29c8dfebe25b8db
SHA512 c424f974ae37e5a4054613c6d7f1e35d4bf9bdfab94893ccd63cb6d56c7633a08e5d721a41b5bf65fcb690798e33d13926fd93a45c7b29e26c5962729cc38fb0
TLSH
T10941D658A7EA0108B377AE5A9BF6A86D487E79771A07D59D00110D8F0672B40D861B37
MD5 SHA1 SHA512 TLSH

Submit Download