hxxps://www[.]compliance[.]eqscockpit[.]com/integrity-line/cases/4338939880?company_uuid=388ed4d6-ec53-4f0d-a9c6-ed854a5bcaeb

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
13/08/2026, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.compliance.eqscockpit.com/integrity-line/cases/4338939880?company_uuid=388ed4d6-ec53-4f0d-a9c6-ed854a5bcaeb
Sample260813-ga3edsha67

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1652	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310730296088004"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{305F5737-2085-4E34-BB60-13C9DA31ED7F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1408	msedge.exe
1408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 2456	3984	msedge.exe	81
PID 3984 wrote to memory of 1652	3984	msedge.exe	83
PID 3984 wrote to memory of 4492	3984	msedge.exe	84
PID 3984 wrote to memory of 4492	3984	msedge.exe	84
PID 3984 wrote to memory of 3132	3984	msedge.exe	82
PID 3984 wrote to memory of 3132	3984	msedge.exe	82
PID 3984 wrote to memory of 3132	3984	msedge.exe	82
PID 3984 wrote to memory of 4908	3984	msedge.exe	86
PID 3984 wrote to memory of 4908	3984	msedge.exe	86
PID 3984 wrote to memory of 4908	3984	msedge.exe	86
PID 3984 wrote to memory of 3508	3984	msedge.exe	87
PID 3984 wrote to memory of 3508	3984	msedge.exe	87
PID 3984 wrote to memory of 3508	3984	msedge.exe	87
PID 3984 wrote to memory of 1608	3984	msedge.exe	88
PID 3984 wrote to memory of 2372	3984	msedge.exe	89
PID 3984 wrote to memory of 1608	3984	msedge.exe	88
PID 3984 wrote to memory of 4896	3984	msedge.exe	90
PID 3984 wrote to memory of 1608	3984	msedge.exe	88
PID 3984 wrote to memory of 4372	3984	msedge.exe	91
PID 3984 wrote to memory of 2372	3984	msedge.exe	89
PID 3984 wrote to memory of 2372	3984	msedge.exe	89
PID 3984 wrote to memory of 4896	3984	msedge.exe	90
PID 3984 wrote to memory of 4896	3984	msedge.exe	90
PID 3984 wrote to memory of 4372	3984	msedge.exe	91
PID 3984 wrote to memory of 4372	3984	msedge.exe	91
PID 3984 wrote to memory of 4424	3984	msedge.exe	94
PID 3984 wrote to memory of 4424	3984	msedge.exe	94
PID 3984 wrote to memory of 4424	3984	msedge.exe	94
PID 3984 wrote to memory of 2492	3984	msedge.exe	95
PID 3984 wrote to memory of 656	3984	msedge.exe	96
PID 3984 wrote to memory of 2492	3984	msedge.exe	95
PID 3984 wrote to memory of 656	3984	msedge.exe	96
PID 3984 wrote to memory of 4400	3984	msedge.exe	97
PID 3984 wrote to memory of 5100	3984	msedge.exe	99
PID 4400 wrote to memory of 1696	4400	msedge.exe	100
PID 3984 wrote to memory of 4240	3984	msedge.exe	101
PID 3984 wrote to memory of 4572	3984	msedge.exe	102
PID 3984 wrote to memory of 4048	3984	msedge.exe	103
PID 3984 wrote to memory of 4980	3984	msedge.exe	104
PID 3984 wrote to memory of 4980	3984	msedge.exe	104
PID 3984 wrote to memory of 852	3984	msedge.exe	106
PID 3984 wrote to memory of 852	3984	msedge.exe	106
PID 3984 wrote to memory of 1408	3984	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.compliance.eqscockpit.com/integrity-line/cases/4338939880?company_uuid=388ed4d6-ec53-4f0d-a9c6-ed854a5bcaeb
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ff96a9ac188,0x7ff96a9ac194,0x7ff96a9ac1a0
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,5371028532457652358,12440990623701500188,262144 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,1686083782556388348,4218372372788463713,524288 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,9421167002566559355,7499827127454541190,524288 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,8410447009108507542,18260204599270660928,2097152 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,11307934529537349146,10403133225986594242,2097152 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,6139522940198415817,12445262111507317508,2097152 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4124,i,7531332049223907093,745986503781062445,2097152 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:9
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4224,i,15479938537321940350,15047280353021045029,2097152 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4260,i,9367527489516747920,184008637118252905,2097152 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3592,i,747985815521434618,9703134945434748538,2097152 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,17678298993500333371,4095286616833295256,524288 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,500669312645880072,6656945054923983615,524288 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,13889107703572799590,7800638717817933403,524288 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,12451237713660047392,6463422377997574121,524288 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,12451237713660047392,6463422377997574121,524288 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,16634602422087790627,16881513394946920861,524288 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,8445376985266774106,5285158452272711204,524288 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,1849128905108983177,10304321099801795175,524288 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,16570824986625940790,1366136021624389878,524288 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,11368754311409151553,2949340580194707876,524288 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6792,i,8721159039487722292,4970368177416633307,262144 --field-trial-handle=2476,i,9939412227777956839,1079462850581404840,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8305523a-cc22-4d88-b770-3b2ef336205a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8305523a-cc22-4d88-b770-3b2ef336205a.tmp
Size 8KB
SHA256 545ca8bc2fc0bb68c704843f5b64aca90d4b34006a7b68418e1e15b37fc10450
MD5 ba71e5c9d4d82c6bc9e5e499b101fd0f
SHA1 02610eee234ad89b76839fbd903319864347eb7a
SHA512 e394db7f198a41522253ae3e4aec0525ee6b898e9eb9530d2503ac1c070c041d01d3a0cc928621ba3250753330810d293d378e1a41ac002e094522a5e04d3182
SSDEEP 192:qGNg6d9402QmiUyfvwTBF2oP1eJHqGwad0U6:qGNg6740SQYTBFptexY1U6
TLSH
T1D502D93568783CBB9EA36E45B4873B276ED5112FE6942B84D9E81B0C41DB38C2307976
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 991008b9b0595d73a834485ea29586af44591a386941c327848eaa62bdda1d31
MD5 361e52e3af42b9ecd11b87e3113f10ec
SHA1 317337f4abf4ee15758d7ffaf16d705572917ecd
SHA512 176061638831bb89d64d18adaba36e7e65a39b64768b1d30891a8116bd979cdb3c938e30394f379c786c984d6a7590d1d7d0b299de23e12b878648fc110b41a7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T1ACB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

8d1c1374-ff2b-4b39-9ba5-0e59baaaa823.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d1c1374-ff2b-4b39-9ba5-0e59baaaa823.tmp
Size 13KB
SHA256 d2f6e4e9088220cd677f8cb5b57e1c9392c8b4a6ff9df6642a6a07fb1b04cad6
MD5 aa8fb36f45b938bbecd7c36c77e6f97d
SHA1 b9ed68a8def739a1997086ad8cebb0d5f27a6f46
SHA512 b7e7150ed9250b92047bc09aae42c2f3276c723968a3788cb778c43559a03217dd369987837c24a1df1787ae71b819a0e0b0b7807bd95f36f8d7042d77dc03db
SSDEEP 192:sxZNRdyM/jK1Ml8MFR/fZs2eqIDIdpFFw/W6+WNl1Ft/Y0uBHigHm+WIgrJ:sxZNLdR/fZs2eqIcY/bb/5uKB9
TLSH
T15B52D612AA346977CCDBD219B955BF63D7F9146392900E44AEFCCA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8a2447a4cf8be309bb74b80e6dd7c41c686786c5491679db37e9ea0b5a82cdc0
MD5 97d819524ab1e752f9b4b8be0ae29709
SHA1 5fce9ff86118c31622c7d53a8d2cc1aa1ca8ec0a
SHA512 bee660116cdddf13d1ab579b590e036b3e3765b7dba905528ca00e5f6a55455a8dfa7fac627a6648aba1fc276d659222c088bd561aef13202d839190db79e2a1
TLSH
T1C371B34C01614563EFB90E3292C221C5B8B2468BDA436D290F50BBBADB1672ECD177FC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 371916ddc22ab309fc6384e7785bfced33282d596c77bc25da2052628d341964
MD5 8aa33e144a5375e8277ff6e37ddfacfb
SHA1 2a006509c989d68d93d5aaec462032de217f1e3e
SHA512 becd78eeb9705f53ee34a1bb81605217587a036ec9101269a1c3b50e70c3df5b1b26e5a9c6960f28070bd2864fbcd240024a3158b33d568abb4b22e8dca44557
TLSH
T166419CF743B1856ECE1092F4AA149E2BCF6C0511075C786AC6D4ED67E3F34B1E08569B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d24050a0-8b6e-43e1-a41b-5f0a2f8fd467.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d24050a0-8b6e-43e1-a41b-5f0a2f8fd467.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6b8cfaf714473b0656345295578d10b6f2dd1007eb8d08b013bd84af6358b704
MD5 5d5c18590e6b6e362b06205dca121694
SHA1 c5b46b36fa9a4e5545ac1d87ab3cada769cdd0db
SHA512 21eb02943f4530de7559bd6658a5ba27f13039aa7c63cf25a13d4f4f7d25d841afbf21a2b25e9dbded0e51b141c89aca9393badcb252fd81fca4dbbd2fbca372
SSDEEP 192:sxZNRdyM/jK1Ml8UQCcFR/fZssZbqIDIdpfFw/W6+WNl1Ft/Y0uBHiRc/+WIg59J:sxZNLqCqR/fZsEbqIcm/bb/5urB9
TLSH
T18462D856AA345A77CCDBE21AB955BF63D3F5147391900E44AEFCCA1C00E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 e980daacbbf9a3bca692845d05620b7767d23fbf5ab311cdb35b2e76906e1419
MD5 b5c18e005041d5b0e2873fffb0c1bae5
SHA1 6d24c4ebe54792e13ee0f43ca7f4231b1a7e6710
SHA512 7a143cc177a2438d440c47baa60ffbd57b3ee276f7282d8f74969516f54a83fb19041a4fd07d50339a175e151064a31fc1658071141c2c35e0fa1bca7fe7b9ce
SSDEEP 768:Ng/Lh8dF2/kWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KjLl/060lQirozn:Ng/Lh8dF2/kWRmAcQ3wu1jaKKjLp0Dls
TLSH
T152E23A3B690CCB7E4F840EADEC266F976ED801CB66684D5447FA894C03C73EA411A59F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 bcf6208ea7d74abca73e386beb83452fa80139156c9db529f2e657ab2c66864c
MD5 0d5ab88980e3df2b5adce16a8803d260
SHA1 725e8885e1312f679d7b9685e45754f2f4979edb
SHA512 c012900d85a46424df0a11b1f1360690ab3d75491d2a1db2cb55dd824665cf7105afa4abdc5f8928252c25523cbec208757cfc24d5421f076cdada29e39d7b5e
SSDEEP 96:K08gKFGO/mKM06a6sK7i6/8BAMOqegKy7zUUgKM1UGgwkUrm0:a+lHn/8BAMOqefy7AUI1UGXkUrm0
TLSH
T184B13596317A43123C7E2908A655CB271E52B3BB3464E52F77A810B71E67E211CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b9ff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b9ff.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 bad65d9f65c05e25a31f3d0682d325e9a9a2a0a12d4e2aca9f56576eb0e5ffb5
MD5 b0465dc8a823c0a9a7f752c52ac47163
SHA1 54651cd6d72471ef55f4dd4d6530b01baa227328
SHA512 16f3c84271afdb4ac74e24c4bb2688a6593c89e24bb6167cbbd380a02d9d897c89194f42b5884a54ce725633a692e51bf21966f90f7fd01350d95ae21a713cb8
SSDEEP 384:0ZcIn8NIUImc40HRui0Fptex8nfGR8OOPrXLpe8C/4yu:yn14Jb8x8y8Oi9PTyu
TLSH
T119928D7158382C77ADF3B955B08A3A179EF98127F6C42B84A6DC9B0D05DE29C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 bfeb01a6eca089f51f87ff338d6be42fadd88eaffe863253faf6768c52e895ae
MD5 1a0f3f8b8409746d526ec572b184d11f
SHA1 db488f97fef62fcc3ea48f218dd7cdf8846a0f08
SHA512 ad03370afd1c68699ed725874b57c0f7cf47f1bc2a59dc7b3b0de2a5dfa6318ac3cf4689e118c16f33d154d610c3e91b4f433fc8855644253b3786681da4c3d2
SSDEEP 384:4ZcIn8NIUDmc40HRui0Fptex8nfGR8OOPrXLpe8C/4yu:Gnk4Jb8x8y8Oi9PTyu
TLSH
T16E928D7158382C77ADF3A995B08A3A179EF98127F6C42B84A6EC9B0D05DE25C1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 faa077769c7a40a8418d83773885d490bbaae443e117d21db6d91d25c7dde230
MD5 a06ff81e2428d6a0e7bdb9ed129bb8ca
SHA1 0991eb3ee863d6375a7310c52b42a34fe6ac0ae0
SHA512 28c735e10547cee595d60ca37f9214b400769c0a71716b7f76d3f09912645a1230f5ffe612e0300370ae074bbe5713872e6a3c0b3346271a331e1933e5435305
SSDEEP 384:fiFiZcIm8NJ8TUNTUlIlAmc40HR/i0Fptex8nfGG8OOPrXLpe8C/4yu:qFQmAwgoNJb8x8n8Oi9PTyu
TLSH
T1F7D23BF248E75836EDAE5B53A37D2E139EBDC163B5806944B7C8860CCC9A17FC306951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7b6f2f4e4591e26add360a2d03f13bc2bf72a9c74040c8eaf262e715a7c0268e
MD5 5477d8e4d1255db3ce2fabd94a3f3351
SHA1 b83329376dc58366e6bbd14187c72376568c8c03
SHA512 f6e325d4e1c14b902b146b7a8965c3822c2fcd994279271107b5dc88e3c999bdffe7038d1b811170d35d3040d50cc85ce70c23263752b4fafcd1e45748ee979b
SSDEEP 192:RGNq6d940RQmiUyWw+BF2oP1eJH8J5w+1M+iD1qxU6:RGNq6740vE+BFptex8nfGT8U6
TLSH
T185121C3658387C379EE37855B0873A27AEE6421BEB847B44D9DC1B1C41EF25C130B966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beeb6785-3f10-44ce-9257-821217857f32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\beeb6785-3f10-44ce-9257-821217857f32.tmp
Size 20KB
SHA256 0170899dc99e6b76d579ad6103f9bdc5e2dd67182c23f3e9f76834ba45455bc5
MD5 a59c2fadcbc2cd1658a1763afe199c5b
SHA1 c353bf18f084305785e38646a3493fd358ed32d2
SHA512 b9c6e022019ffd76516346b90e98262f607ea42e6351c342877007b3bbb6cf584ad3c397e2f7a11615efac584ef205da42f2c274440ef02443873dee2721a70d
SSDEEP 384:KZcIn8NIUAmc40HRui0Fptex8nfGR8OOPrXLpe8C/4yu:onT4Jb8x8y8Oi9PTyu
TLSH
T1F6928D7158382C77ADF3B995B0863A17AEF98127F6C42B44A6ECDB0D05DE25C1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a78ba9c-b20f-47af-9464-a64749a0e9d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7a78ba9c-b20f-47af-9464-a64749a0e9d5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download