hxxp://127[.]0[.]0[.]1[:]49153/

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://127.0.0.1:49153/
Sample260814-dfd27stbna

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2156	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311498140247213"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{05EBB2B9-7C0F-4D48-99E7-EC7DABCB8936}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 848	1956	msedge.exe	88
PID 1956 wrote to memory of 2156	1956	msedge.exe	89
PID 1956 wrote to memory of 3820	1956	msedge.exe	90
PID 1956 wrote to memory of 3820	1956	msedge.exe	90
PID 1956 wrote to memory of 3820	1956	msedge.exe	90
PID 1956 wrote to memory of 4812	1956	msedge.exe	91
PID 1956 wrote to memory of 4812	1956	msedge.exe	91
PID 1956 wrote to memory of 2196	1956	msedge.exe	93
PID 1956 wrote to memory of 2196	1956	msedge.exe	93
PID 1956 wrote to memory of 2196	1956	msedge.exe	93
PID 1956 wrote to memory of 2280	1956	msedge.exe	94
PID 1956 wrote to memory of 2280	1956	msedge.exe	94
PID 1956 wrote to memory of 2280	1956	msedge.exe	94
PID 1956 wrote to memory of 2644	1956	msedge.exe	95
PID 1956 wrote to memory of 992	1956	msedge.exe	96
PID 1956 wrote to memory of 2644	1956	msedge.exe	95
PID 1956 wrote to memory of 2644	1956	msedge.exe	95
PID 1956 wrote to memory of 992	1956	msedge.exe	96
PID 1956 wrote to memory of 992	1956	msedge.exe	96
PID 1956 wrote to memory of 684	1956	msedge.exe	99
PID 1956 wrote to memory of 1980	1956	msedge.exe	100
PID 1956 wrote to memory of 684	1956	msedge.exe	99
PID 1956 wrote to memory of 1980	1956	msedge.exe	100
PID 1956 wrote to memory of 3884	1956	msedge.exe	102
PID 1956 wrote to memory of 4912	1956	msedge.exe	104
PID 1956 wrote to memory of 4912	1956	msedge.exe	104
PID 1956 wrote to memory of 4912	1956	msedge.exe	104
PID 1956 wrote to memory of 1568	1956	msedge.exe	105
PID 1956 wrote to memory of 1568	1956	msedge.exe	105
PID 1956 wrote to memory of 1568	1956	msedge.exe	105
PID 1956 wrote to memory of 4020	1956	msedge.exe	108
PID 1956 wrote to memory of 4020	1956	msedge.exe	108
PID 1956 wrote to memory of 4020	1956	msedge.exe	108
PID 1956 wrote to memory of 4872	1956	msedge.exe	120
PID 1956 wrote to memory of 2004	1956	msedge.exe	121
PID 1956 wrote to memory of 4500	1956	msedge.exe	122
PID 1956 wrote to memory of 4756	1956	msedge.exe	124
PID 1956 wrote to memory of 4756	1956	msedge.exe	124
PID 1956 wrote to memory of 4756	1956	msedge.exe	124
PID 1956 wrote to memory of 3772	1956	msedge.exe	125
PID 1956 wrote to memory of 3772	1956	msedge.exe	125
PID 1956 wrote to memory of 3836	1956	msedge.exe	126
PID 1956 wrote to memory of 3836	1956	msedge.exe	126
PID 1956 wrote to memory of 3836	1956	msedge.exe	126
PID 1956 wrote to memory of 5080	1956	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://127.0.0.1:49153/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffbf87ec188,0x7ffbf87ec194,0x7ffbf87ec1a0
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,5092545639468346156,12716221337295138190,524288 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,13730702261732448178,16271129064996440382,262144 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,16757489009290662015,4812856066931521212,524288 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,8772144047710138522,7143388109620465629,2097152 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,8905255154096696364,12165423720610787673,2097152 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,11987173277593630761,6299125767802687283,2097152 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,15853464344700468563,6687148136015099600,2097152 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,8162938677125826007,1048855766506060693,524288 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,15113139049619553405,1130462207097937098,524288 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,15283939461974244403,4297329190535247003,524288 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,15283939461974244403,4297329190535247003,524288 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6188,i,9275675873204795114,1342721613690023453,2097152 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4900,i,8804465335312641488,13329715572815848536,2097152 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6288,i,8477188713473383107,16728897766727981940,2097152 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,3943027023824742199,11402407518526006127,524288 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,15010726687854999340,2582978465173607610,524288 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,7427268082951145071,8971551850974905475,524288 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2944,i,14631646265623362623,17858021129160492731,2097152 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,4450872780913084413,4514393741987091122,524288 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5344,i,821795710298485374,14889093148980751645,2097152 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5192,i,7658555488692825571,15167733489403606881,262144 --field-trial-handle=2188,i,15516050361253152156,3644043023760380373,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fb4c320fbc017217ffa1580e6afefec299743371b88b61640a30c98f440f1dfe
MD5 5d21aabe1b1ab1226b5020e9daf0f26a
SHA1 8e143167cf57331b307d194792a6ff1d234218b9
SHA512 5ca67536cd751dd9c40bdee7c11a5e12d3977e76df8579225daeafba37638d54321e64abff0a7067d5e7523269f3522e4ef02331fdbf8591125120a7e3dcb277
TLSH
T10671E93D040E4469D3AA03F364F213167D71BBDBF5D32E957190AAF028017D68E4F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588e60.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588e60.TMP
Size 3KB
SHA256 f1539bf200405aafdffeb257b6ba0b2c2a0a6bbd1115777afa06d83b77667353
MD5 a4a153a30f46e7f8cf4b42a7abd85afd
SHA1 56218d0f11608e615c2dc80b4be55d71bf65f0dc
SHA512 203928675eeffba8347296c944daf99907e004b10f5df8282b15e83ccbbf37242da5f8c89ebc947406759464365b59a3676b7c5655ca31d9be037195671d0dc9
TLSH
T1CF71C83D044E4469D3AA03F364F1171A7D71BBDBF5D32EA571949AF028053D68E4F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 2ace0cb7ea50ad286be99d807054c9d91d47fd72222ea96c2b2c6de087ef44dc
MD5 596b9dc84f5d7e05596e85938bc0962b
SHA1 687b56e7933dc04e76ad228d033e4a84578660d9
SHA512 7a65fcb212c0cdf2d83ae3c114b7071686dd9fece7d17aec3c4fe2e25ceb47a4cf4803f94831806d81f63c578543249c9b84ca47102daea5dd0c95a5c0f38efb
TLSH
T154117DB3C3D5956EC90116F06A24EE1BDE2D0506821C7D55C9D4EF27D3F3075E50259B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 56b9dafe0aec58010ec2cd8bf38515d599a09e841ef11f5c1da3f550ba4aa72c
MD5 2dde1e77710577ef744b77001ec76b8e
SHA1 cf81b55f8ca43bf71e247173843bd98263d5c834
SHA512 c3b50e960dfd58bef98aba0656fd89a18aef3b60501937f65025c8826d9b60468497bb6153d6809640e2eb8d917ccaa8a99696f108205a06371b65c4a20c06e7
SSDEEP 192:sxZUR7k8/fmsAvH15IdpdCHW6+WNGYzM5YrgIg52OJ:sxZUm8/fmsIH0sHbGf1
TLSH
T14022D8526E68A97B8CCBE60DBB157F13D7F9507291D10E48AAFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 48e6bbfe9f6a41b4657132c89d5acbc4dd7c52fee9df9ff86d6b037b3a81bd24
MD5 a71265eed0b6ce511633ff74de76b466
SHA1 88032a5fd5b96d8b9d0b0d0aa82e0d24e99261cf
SHA512 b25f56e6f680b4eede73c2b690cb39adcdbe7a661992918b6355d043e41a8520960ad44d0190dacfb7e8085ded64de5802eaad64528bb4b146b0093b83325bd4
SSDEEP 192:sxZUR7k8/fmsAvY15IdpdCHW6+WNGYzQ7YrgIg52cJ:sxZUm8/fmsIY0sHbGxD
TLSH
T1A422C8526E28A97B8CCBE60DBB157F53D7F9507291D11E48AAFC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 4b936d119e1227b402b85320de48715e0f9bd70471872176702e826b0df7a502
MD5 2c076c7b0d1cb93ab867fc2b492a923b
SHA1 c5f95d50785d80f677cae11f563360c18b3c208a
SHA512 a4e13db1e68dcb93d80f5faab6c61de47971ab740c8466299db4d263500004cc009c7afe507c84651f97e6bbf96168026e80cf166bf661e0f00f5bbd005593c0
SSDEEP 192:sxZUR7k8/fmsPY15IdpdCHW6+WNGYzQ7YrgIgrJ:sxZUm8/fmsPY0sHbGx9
TLSH
T15F22C7526E28A97B8CC7E60DBA157F13D7F91072A1D11E48EAFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3d5c7ea4e32e55b1648024f60e1508fdfb3edeec0f0efc4def988f659d24ae51
MD5 b0934c5a440d3ee6ae601989b64be44f
SHA1 d90c62a60311f6f82aeded6a7971315084bd7134
SHA512 863ee18671f2b975b795048d2dec179cbb0747d6b6e2050b78568b719d10bf2e82e340a422e7ba62a6d1e478789c76fd254d8fa32ac52fc743f78095024e0369
SSDEEP 768:znk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSB4roydYJ:znk7u70WvqiEau1jai5LA3BDtJ
TLSH
T15CC2E93B744CCB7E4F801E9DAC5A6F973E9802C7A6948D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4bb3d98df5fadd0a18a20b0557eb1e153f08319c70ce50815dda07c25ecec886
MD5 d29df3fd1efdbb5d67e6ed824c7b1d1b
SHA1 8ea17e46305b1d1be3456527f5ffd5c6cfc2b428
SHA512 a4813a3b773d4fb1b78a79e50f0bc78cb414e21f71c8780a9b0ab440b2c99f5af596051b653ca8647fb00aa80711e21e5b1aad7ab502d99dbb65192dd7a4e1c6
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTfTINKIsgPyBKIfKzq8Ly9/IhKow:KIbCKcfTWKIsSiKoKzqCe/mKow
TLSH
T1C791821935BA1A013C7E7A4C92AA86278F827553711CB46F7FEC04724DAAE118DFD8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592a33.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592a33.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a3e4865fbb2dbb7e954b22aa4b1cb8c2244d9763ea1bb4e0482632d6cbdbabe1
MD5 74b86ef3f2f008823ade9a40a6c73f82
SHA1 dfcad6b706376e7e54eaf02854d18c4a18378822
SHA512 ad31a15004dc2c5b3d9363aee97f6a94fb1876e0af24582e1f90f57d8aee8a30b04bbe7a17206ffc3714278b158bc55c44113edc464cf81ee94e5bcb6ef1493b
SSDEEP 384:8ZcIhsNaagbFCUkQd0mEMZ4OOPrXLpe8C/P:qhNAURkMZ4Oi9Pc
TLSH
T1F7929E716CB86D67ADF6FA85E58637035FF84167F2C42B44B2EDEB0C05DA6A80307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 be2f5ea65009ee5680961681ac6fa57a8e0594bff4374f290ccbc78e9675a8b7
MD5 2e52c5a54e3b0a6dd0c483b5e8da6676
SHA1 2aeb7dfed6ab5b91864a4efffbf8fd4dfb9d32a1
SHA512 e45d9158a52659b11d970efb5c66b44215cfa378b3852644266e50ed5b4b995226e6e8d4933acb924ab6c857519845cb85dc59ea0a6f1eaedc4ab78f94f5fe6e
SSDEEP 384:NiFiZcIZsNi8TUNTUlIlvgbFCUkQd0mEMY4OOPrXLpe8C/P:EFQZnwg2AURkMY4Oi9Pc
TLSH
T1D3A27C725CA89D6BADF6AF85E98636039FF441B7E5C5AA94F3DCDA0C01DB1A80307C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 474af789b68c8411d74e4331a6d1a134e3954dd5598a4fbf78c22698b43f357c
MD5 bc94e5854fbc49f62a7d0d08c6cd5cd0
SHA1 af78eb07e34540092b77824b779383043c2fe5e5
SHA512 bd28f18ef853def16804a4957a29385cd83f98e25b6543f972f3b69939f49543ea9aa2d3892d4096708c9b257b1a82abb4f47f4b6b62d4782e5f883cc77dd14a
SSDEEP 192:MONf64BAQmiUyK1lW5GBPKcl+FdGuom1baD75U6:MONf6eApzWzd0mSNU6
TLSH
T11102FA34AC796C7B9EB2BE45F4863B175FD8103BE6945B44EAE81B1C00E725C234692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f28cc34fc84e9b4784cee61cfa495f5a6caa12e79bfc46033f101be9c558fe7a
MD5 2dd29abda0d01503495256ca1aebf5bf
SHA1 55b7ee5cb2f42c8a74703c2962217161498e1715
SHA512 fb607170192cb4944ffce6b94e9e92e0050c12b08d3a422da0a21e2d0be2c7f5f9972949ed3828fdbfcbc15dbe638e8aa294c3b16834f198ec1029e701befdbe
SSDEEP 384:hZcIhsNavgbFCUkQd0mEMZ4OOPrXLpe8C/P:ph+AURkMZ4Oi9Pc
TLSH
T18C928E716CB86D67ADE6FA85E58636035FF88167F2C42B44B2EDEB0C05DA6680307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d97226319b7b5bf517c004db9f122a7fbcacab7b9dab0505426cea619c845e08
MD5 7a321ffed281ef1166a0db104ed9f0b3
SHA1 b7d78c984fecbef9b0df425c8b4bbd691970825b
SHA512 f816d9ba16d06bac05ac76419a61d78cfda1fedb2b5058b2f4e4428adcfa7e45782f38a327741e3d4a3451fb8324bd813a1b85c2142562f1d3071ecae76bf1cc
SSDEEP 192:7ONL64BTQmiUyllk5GBPKcl+FdGuom1YKEMTWwpqRU6:7ONL6eF0kzd0mEMf4U6
TLSH
T13A121B316C74AC6B5D92B545F48736135FE4416BEA856F40E7ED2B1C01EF6AC230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 820b3c3532b0800ac35b0dd26b14f8dd60a55e678c4dfa5766f1fe98f685b40b
MD5 e0850f035f830b5ace86dacadf25e46f
SHA1 953c16167d3533db4d5df1368da73367125e4482
SHA512 68573d8e0f89e25b5d4d3717de0d19941b737953ffb4d4f43f2afdf38a9d4501aafa8a696130162f7fa63029c18e3fe94c34ddd75e079203a647aa4864f35aa9
TLSH
T1E341095CB6F91104B3B7AE5AAFF7A46D587B78772E06D45D10110E4E0A36B00C972B37
MD5 SHA1 SHA512 TLSH

Submit Download