hxxps://doublehorninjurylawfirm[.]kit[.]com/913002af7f

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://doublehorninjurylawfirm.kit.com/913002af7f
Sample260820-vz4kmsgk4v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5052	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317204053979680"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{3727D0C0-7637-4EDA-9499-9F9FEC754D46}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 864	4680	msedge.exe	88
PID 4680 wrote to memory of 5052	4680	msedge.exe	90
PID 4680 wrote to memory of 3124	4680	msedge.exe	91
PID 4680 wrote to memory of 3124	4680	msedge.exe	91
PID 4680 wrote to memory of 3124	4680	msedge.exe	91
PID 4680 wrote to memory of 2044	4680	msedge.exe	92
PID 4680 wrote to memory of 2044	4680	msedge.exe	92
PID 4680 wrote to memory of 3740	4680	msedge.exe	93
PID 4680 wrote to memory of 3836	4680	msedge.exe	94
PID 4680 wrote to memory of 3740	4680	msedge.exe	93
PID 4680 wrote to memory of 3740	4680	msedge.exe	93
PID 4680 wrote to memory of 3836	4680	msedge.exe	94
PID 4680 wrote to memory of 3836	4680	msedge.exe	94
PID 4680 wrote to memory of 5116	4680	msedge.exe	95
PID 4680 wrote to memory of 4396	4680	msedge.exe	96
PID 4680 wrote to memory of 5116	4680	msedge.exe	95
PID 4680 wrote to memory of 5116	4680	msedge.exe	95
PID 4680 wrote to memory of 4396	4680	msedge.exe	96
PID 4680 wrote to memory of 4396	4680	msedge.exe	96
PID 4680 wrote to memory of 2144	4680	msedge.exe	99
PID 4680 wrote to memory of 3804	4680	msedge.exe	100
PID 4680 wrote to memory of 2144	4680	msedge.exe	99
PID 4680 wrote to memory of 3804	4680	msedge.exe	100
PID 4680 wrote to memory of 4540	4680	msedge.exe	102
PID 4680 wrote to memory of 3200	4680	msedge.exe	103
PID 4680 wrote to memory of 3200	4680	msedge.exe	103
PID 4680 wrote to memory of 3200	4680	msedge.exe	103
PID 4680 wrote to memory of 4000	4680	msedge.exe	104
PID 4680 wrote to memory of 4000	4680	msedge.exe	104
PID 4680 wrote to memory of 4000	4680	msedge.exe	104
PID 4680 wrote to memory of 3360	4680	msedge.exe	105
PID 4680 wrote to memory of 3360	4680	msedge.exe	105
PID 4680 wrote to memory of 3360	4680	msedge.exe	105
PID 4680 wrote to memory of 2760	4680	msedge.exe	108
PID 4680 wrote to memory of 3648	4680	msedge.exe	109
PID 4680 wrote to memory of 2724	4680	msedge.exe	110
PID 4680 wrote to memory of 3912	4680	msedge.exe	118
PID 4680 wrote to memory of 3912	4680	msedge.exe	118
PID 4680 wrote to memory of 4328	4680	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://doublehorninjurylawfirm.kit.com/913002af7f
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffece17c188,0x7ffece17c194,0x7ffece17c1a0
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,11662491046423707284,13502174218049360709,524288 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,12413063701186835445,14490205420624203446,262144 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,8094934995668226321,8559123864937060574,524288 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,11986580072169735221,15450237953290703613,2097152 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,4530028942814878332,9118379762725433734,2097152 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,4413942936116438414,13993294719775773649,2097152 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,12137485754193937639,7419928087874998796,2097152 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,6196663539031136946,6639336834580603771,524288 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,3347290288670075089,5517539516845324836,524288 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,4703248828076039234,5709265525090682368,524288 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,4703248828076039234,5709265525090682368,524288 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6236,i,2757801098630494496,8479861995380149116,2097152 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6404,i,3515950075578840088,2886476538255928749,2097152 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6416,i,12952735564009540016,2756475572125012175,2097152 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,8492006226755982449,2014961060588298374,524288 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,15526448160362930102,2833766224878943653,524288 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,17003748078406838692,2002961891593345619,524288 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,15043184133613876435,8635080147680665485,524288 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,10857734678096814382,10881155032239383903,262144 --field-trial-handle=2344,i,8547779907958024548,12723508910908333047,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 5fe1b45d728dd281cfc5c3aed50cd3b8dd21b9350f4602c632ce422b49e84a4a
MD5 1e6146debf8e2be145220aea00d022d9
SHA1 699d6070e2491c085ec20d1df0b8651ff3d98081
SHA512 5e11a6056a4cd4a6116108c94b7fc1d4f1d1cc6957f443732f6647bfa0eef106ada4c90c38106582b85e30f1fe7a4a52cf1eac412b0a36be81644d8002d79962
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7K:fwUQC5VwBIiElEd2K57P7K
TLSH
T162B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4a4b0d8588f4b54b32c9c9d106de49b71d6746138c50fb0e79f1348520587121
MD5 a30b65642a87620e408d93075d1ee7bb
SHA1 a6589be2e55d4e755bcc32aa1b5791ac0f8ef174
SHA512 e73f237fd2dc9d49b9febe8a32a2803ad6610558907dc8ae3b85724ba3d34945cb592839c58eb6c80702f3ca59deab41d8a3e3fd005b6692a2a43d9d9bb89ec8
TLSH
T18A71E85C05E26B45D7D23330E0CD391B3171D49A0A27BDE68BD4C4BC5F1675C9E32058
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f6bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f6bf.TMP
Size 3KB
SHA256 10de79e2a4820f03390e4790d4e616e09ff364af78d4b6ea6d35fc4e3e6dc3eb
MD5 f0bbac62be1e534f59b88e498300b970
SHA1 58d391399fe912ab8ce3e762589a33941f33bc62
SHA512 31bc0ec99e72f31e38b7695b2b57a3fb32d0def58c8604de82a448d47a1457715290b86baa96377d657d0e5cea8abe5db149ca69e67aa42e471e77c7d9855bfb
TLSH
T1CF71D81C05E26B05E7D23231E4DD3A0B3571E89A0A2BBDE59BC4C8BD5F0671D8E7101C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c307f6b3945a226af2bc3b545b16249791190360b77d69a137d5bd20b7204c6e
MD5 5dda6871b337cc9611a8dfea1e315338
SHA1 03ae97db4f1cf60bdce4969509f285c724b85511
SHA512 bae9ec09d64c1018f848d154359deddd7a13fd7e4bd8f0bd0460eda08ee38ca4e6b7a4bfa3b0bfde6a0b1529f791c3d34ad1396ca32dce33cf082720c2a20abd
SSDEEP 96:D0Og4DKdSzVnYImYt4ICAGc44ed5r1FBq8BwQ:D/g4DKdSpnYImYt4IRGc4vd5r1TqoT
TLSH
T11CA1ADF683E48ABDC91192F06A166E2ADF1C1465032C7C5AC5E4EF5F93F28B1E14260E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 796bceefb2a629cb6b6111e431caf01a8c452a0c1e744e8459fa5335ff9b0e3b
MD5 4c016bb9888b9a22e7278fc528dc3314
SHA1 b4c48c0f1d8f42aa4df678e735fe1ac9fc63c368
SHA512 d4a0cff0fd45e3e520f52a4dbd7e2146d7f53436a8ac1d7f3690f29b2a9fa616203ea4efc88ff006d082946dbd72347161e901d377939551e428588d89afe8a6
SSDEEP 192:sxZFHRyyM/jK1Ml8Mkyd/fS8skZpQIdp44xHW6+WNIOV/YwmwkPHIgrJ:sxZtEM8/fPskZ3hHbP/G9
TLSH
T17F52E8116A34A977CCCBD209BA41BF53D6F9047292944E44AEFCCA1C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c78ac30a67c34890af687b6dad4225fb26ec552b623e41885847827f360db9e4
MD5 5ef70d8fa053e737277b2029cee41efa
SHA1 33dfdd9372cd6db02a2694ced395c21a02690765
SHA512 964dadd4fceb3a795b51bb6c17c8f2368cd8c22813a566d9bf9afcdfe065101d455f4798cd640486ffd8d7cbd60cb0e1a4267a1c03a8884896db282bc4b05d9f
SSDEEP 192:sxZFHRyyM/jK1Ml8UQckyd/fS8s5MEQIdpe4pHW6+WNIOV/YwoRvPHIg5VJ:sxZtEqn8/fPs5Mo3HbP/GJ
TLSH
T11352E7156A34A977CCDBE209BA41BF53D6F9447292904E44ADFCCA0C05E3BDD222782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 015b73137fd9a949e24ec56d0a72a54e416e560d55ff8f089ece2350de4bcf5c
MD5 b1a9bea813baf1152679e3da37275cf1
SHA1 8b6d14a88cad7537faa8456dd4cf33e6c0983bf4
SHA512 084f8f5756f7b5c6cf5998a04df565dae60198ed1db7b339cf142d40ea618b37ee1bf165170721ee9f4b30d7f21c3d76f93f10acd174643254bb6651868aad7a
SSDEEP 768:524jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dyrohyhaB:524jeXmWvmKxEu1jacPLZQdpR
TLSH
T1E7E20A3B240CCF7E4F844E5DED26AE976ED802CB6A584D4447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 667bd67c58f6c617b4b8506bf6352dc63d5c6071a9d0774c95b5ebe369b4f5f6
MD5 1dd0d555d1239fe63ab9fda65d409c3a
SHA1 14aa479869b79bc4f2f3534aa97aa60dde176005
SHA512 337d17684df3880a4663b5daffd5a2e2314f1b20d32904805cf196791be1702df9bfc2581d9741f8becb4306a03a2dd84a2bfa991e95ee771f03d5d947749d60
SSDEEP 48:Kk8I3KJ2UTyFDIFKMk403IdKEU4fy2GPqmQYp:Kk8gKJ2C+DSKMk/3+KEUKc
TLSH
T1EE91A64231BB06022E7F294D9594D62A17423163315D747B3BE944BACE6BE220DFDADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a95c1338-c998-4bcc-b4c0-abeb5d8b2e90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a95c1338-c998-4bcc-b4c0-abeb5d8b2e90.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a51ff282a1bfd9ed1688800ce5abe2f412670dd335857c025188a72c37714199
MD5 423171fd8ccab4031a75ff65a1f0e57d
SHA1 dba2566c3bc008b589e418cb3aeb0c8ceb242c50
SHA512 aba7f0eb8f7fd5390d4e0b3ead5c0926f34eec581766984ee534e88c88726c5eedd34416adad53cf2e555460799c8bd103b7784a497961d47b0651ea9773f19e
SSDEEP 384:uZcIhsNcSD+SmI2f+w8kZyXH+2qFmivgUOoX:MheKImbKHlcmiYk
TLSH
T194827D315C78AC774DE5E245F54736139FF850379AC9AF8095EC9F2D009A6AD232BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 434ad45fd23d5de393fc50073b6d6b18dbc00db7e28adb40e3871c012b6a591b
MD5 da2ce707f4053be69a8d62b8f784b9c3
SHA1 27911dac71aecb83f35f7320bd2dd2cb18240484
SHA512 a47eac91fe1bad0debf526b63330764258976de590e769342985bb5d995e2e60f2e2d4d3fc098c4fd2db6c2d093dd7c0518e65831020705aeef8d3a73f9ce333
SSDEEP 384:uiFiZcI9sNU8TUNTUlIlbD+SpI2f+w8kZyXH+2OFmivgUOoX:FFQ95wgxlImbKHlAmiYk
TLSH
T1AEC218F248E79836D9AD9743E73E2D138EBCC063B585AA40B7985A1CCC561BFD316C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9574a17099e3e09f888466e6323ce3441a40cd23e6e1f3258a974d1da61d035a
MD5 3a64e753efac9f9e0769f7d1c443070a
SHA1 0b08d393605db6ae2cabec214f5e20ea5f1a7aed
SHA512 f974da5b3b115db20fdf25a141b68a115634d8ef2dc2be37c054bb58ff8f450ec6712b4f351fdd71f51ddf658aacdb072fd091ffa961b26bbae6f1bf5083a263
SSDEEP 192:EONp6hZ0QmiUyImpc/+jV6jzorkZk5wOZDxU6:EONp6oypu+w8kZb2tU6
TLSH
T14402D935A8786CB78EE2AE45F48737135FE5113BADA56F84DAE85B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4da7bd234d75b2f4e68feb7377a961d24165ce0711bcdba4b122249804d504d4
MD5 a8dce3a54070bf28f16c85e0db0f580d
SHA1 fd4648789d70bfad0787827ab4692eb034250cdb
SHA512 7f842bac93c5988714bacb81141d0e3b7934a4b2329a62502285124bdc5c37ef735685b9d848767208a9adb250d582e7cb186202f66d55a5eb8c8543c7431487
SSDEEP 384:yZcIhsNcbD+SmI2f+w8kZyXH+2qFmivgUOoX:AhHKImbKHlcmiYk
TLSH
T154827D315C78AC774DE5E245F54736139FF850379AC9AF8095EC9F2D009AAAD232BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5b3b0dd9f3977de82e38287e243a279fd69edc52584d2634f0f3dc16bce867d4
MD5 eafb709024d881715974ea698fc5b945
SHA1 99ffa688cf4cb36220a9568b0c45679e9d8ce95a
SHA512 1bf91a049ddf242b4099a9d238e126b57a50d05a72e9490bb6649f57741cb583babe5f79c048f68f419735781f2a24b8ac6cf4854340b58cd09e632fc3447b70
SSDEEP 192:IONl6hZRQmiUyem1c/+jV6jzorkZyXH+2k5cOq8qAU6:IONl67C1u+w8kZyXH+2X9mU6
TLSH
T14D120C36A868AC678DD2B555F48731239FE95127EEC5BF84D5EC1F1C00DB6AC231AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5abcfcec06e38bb3731f9bed8693b39228e95cabc5b2fa76225ad62c1deab753
MD5 9fd75163b4467c1db4e8817268a12a79
SHA1 d0eb7aa7aa8708760deeefd2d7474cee0735dfee
SHA512 27e50df8c208bffac40070bfd25e629c99f379b1e3951701bd7d4035b91e217f3374be5b06901dfb2efee678ba3a1c9232570ceacee44ee509a994462bdfe4e6
TLSH
T148E00243130000E9C424163000531F202FA3C070015103475F70055C1C313006E70584
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe589bce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe589bce.TMP
Size 392B
SHA256 c051b3020634576ab3f254add28da20c2f7a0c41c35759eb2d7050d74a1effbe
MD5 8efd27c6e092c2c3c3c4aa2c914f6971
SHA1 90b5ab29cc79a4a582e9b921e156dbb78f42c150
SHA512 f3d3261d6f57b363ae69a645a1f38889e65cd11cbb93302a1543e76b77e6fd0ecfbefbefd8f7327a160bff8ce9ad57d76c64cca60c162803c8f1763877289089
MD5 SHA1 SHA512

Submit Download

683ca064-6bed-46b4-9d23-5f66cc73d02a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\683ca064-6bed-46b4-9d23-5f66cc73d02a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1889b0aaeb5b0214da9b1b661ffcfd7c91d2edb726e1e5dcaf5a8b5edbe15bdf
MD5 03006a1bf88398bcf8d901e2523cdd95
SHA1 c4f8111691894629e577e741bb8b32188cf990c6
SHA512 2be239673ff6987ccc2bf99be4a08ef11e4ed21c371b8017df826d2e0aad4b3db3346a8b5de7c0987d88d96ba80a2e297e7ea5d3ce172a8e33ed0c8869fc6c80
TLSH
T10C411858A6F91148B3B7AE5A5FF6A86D887F7D772E06C49D10110E4E0632A40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download