hxxp://url7586[.]faithonview[.]net/wf/open?upn=u001[.]6miSNcHBfCu5pKrLqArmiQiIROX9NPvhh0KFRDC0l1EeVwRqZcS1PJEp1zMEt3c3LCKU8DOsH3EnsMUjo2-2BLMZfJWuKF2ryWChQXrr-2Ftm9-2FwB4Ny2aRt2GebMvteK6QO0LKlxGNoTKGRTVM0i-2BWsXQTQRnQy5E3LEfqJ-2B5f63HvO4suavJTg-2BjpzL4fWlsKBdLMjQyv-2FbfF9QnPIr-2FBIeGXc-2FI7MNgnCJoHohjM-2B-2BKW4dT1XJaflR3T-2FrrB90AVSneB9GSupQuVSxCXY8CzjSNqMhL6JS4K01y6nLquPKK8PPudBKOtLkMaEWS95JkB5Kx8CeN5cqrPDCJTOMZN2vN2yK8MC6pghCzzmrd4XQl-2B5hRFbZNNPzE4Zhpujfe4M0sfqnCFxEkHYeLPn4URmDSZl5ox-2BzZCZAgK0pZs53172U80KmJabSKoCVCO8VuUGKCMvCFTyi1xgdok1bhu1HYrlUkyREi8O09wD52UEnTMeeaDuaDuUwTgbnz5QnTss

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url7586.faithonview.net/wf/open?upn=u001.6miSNcHBfCu5pKrLqArmiQiIROX9NPvhh0KFRDC0l1EeVwRqZcS1PJEp1zMEt3c3LCKU8DOsH3EnsMUjo2-2BLMZfJWuKF2ryWChQXrr-2Ftm9-2FwB4Ny2aRt2GebMvteK6QO0LKlxGNoTKGRTVM0i-2BWsXQTQRnQy5E3LEfqJ-2B5f63HvO4suavJTg-2BjpzL4fWlsKBdLMjQyv-2FbfF9QnPIr-2FBIeGXc-2FI7MNgnCJoHohjM-2B-2BKW4dT1XJaflR3T-2FrrB90AVSneB9GSupQuVSxCXY8CzjSNqMhL6JS4K01y6nLquPKK8PPudBKOtLkMaEWS95JkB5Kx8CeN5cqrPDCJTOMZN2vN2yK8MC6pghCzzmrd4XQl-2B5hRFbZNNPzE4Zhpujfe4M0sfqnCFxEkHYeLPn4URmDSZl5ox-2BzZCZAgK0pZs53172U80KmJabSKoCVCO8VuUGKCMvCFTyi1xgdok1bhu1HYrlUkyREi8O09wD52UEnTMeeaDuaDuUwTgbnz5QnTss
Sample260824-j6nbfsvbpe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320330270851405"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{AA0CEC4D-5A16-4EA4-A878-1846D1917CB4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5680	msedge.exe
5680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 432	4348	msedge.exe	85
PID 4348 wrote to memory of 3440	4348	msedge.exe	86
PID 4348 wrote to memory of 1772	4348	msedge.exe	87
PID 4348 wrote to memory of 3520	4348	msedge.exe	88
PID 4348 wrote to memory of 1772	4348	msedge.exe	87
PID 4348 wrote to memory of 1772	4348	msedge.exe	87
PID 4348 wrote to memory of 3520	4348	msedge.exe	88
PID 4348 wrote to memory of 1264	4348	msedge.exe	89
PID 4348 wrote to memory of 1264	4348	msedge.exe	89
PID 4348 wrote to memory of 1264	4348	msedge.exe	89
PID 4348 wrote to memory of 996	4348	msedge.exe	90
PID 4348 wrote to memory of 996	4348	msedge.exe	90
PID 4348 wrote to memory of 996	4348	msedge.exe	90
PID 4348 wrote to memory of 3676	4348	msedge.exe	92
PID 4348 wrote to memory of 4316	4348	msedge.exe	93
PID 4348 wrote to memory of 3676	4348	msedge.exe	92
PID 4348 wrote to memory of 3676	4348	msedge.exe	92
PID 4348 wrote to memory of 4316	4348	msedge.exe	93
PID 4348 wrote to memory of 4316	4348	msedge.exe	93
PID 4348 wrote to memory of 3928	4348	msedge.exe	100
PID 4348 wrote to memory of 2060	4348	msedge.exe	101
PID 4348 wrote to memory of 3928	4348	msedge.exe	100
PID 4348 wrote to memory of 2060	4348	msedge.exe	101
PID 4348 wrote to memory of 3460	4348	msedge.exe	103
PID 4348 wrote to memory of 5684	4348	msedge.exe	122
PID 4348 wrote to memory of 5692	4348	msedge.exe	123
PID 4348 wrote to memory of 5700	4348	msedge.exe	124
PID 4348 wrote to memory of 5208	4348	msedge.exe	127
PID 4348 wrote to memory of 5208	4348	msedge.exe	127
PID 4348 wrote to memory of 5580	4348	msedge.exe	129
PID 4348 wrote to memory of 5580	4348	msedge.exe	129
PID 4348 wrote to memory of 5680	4348	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url7586.faithonview.net/wf/open?upn=u001.6miSNcHBfCu5pKrLqArmiQiIROX9NPvhh0KFRDC0l1EeVwRqZcS1PJEp1zMEt3c3LCKU8DOsH3EnsMUjo2-2BLMZfJWuKF2ryWChQXrr-2Ftm9-2FwB4Ny2aRt2GebMvteK6QO0LKlxGNoTKGRTVM0i-2BWsXQTQRnQy5E3LEfqJ-2B5f63HvO4suavJTg-2BjpzL4fWlsKBdLMjQyv-2FbfF9QnPIr-2FBIeGXc-2FI7MNgnCJoHohjM-2B-2BKW4dT1XJaflR3T-2FrrB90AVSneB9GSupQuVSxCXY8CzjSNqMhL6JS4K01y6nLquPKK8PPudBKOtLkMaEWS95JkB5Kx8CeN5cqrPDCJTOMZN2vN2yK8MC6pghCzzmrd4XQl-2B5hRFbZNNPzE4Zhpujfe4M0sfqnCFxEkHYeLPn4URmDSZl5ox-2BzZCZAgK0pZs53172U80KmJabSKoCVCO8VuUGKCMvCFTyi1xgdok1bhu1HYrlUkyREi8O09wD52UEnTMeeaDuaDuUwTgbnz5QnTss
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffcf500c188,0x7ffcf500c194,0x7ffcf500c1a0
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,13001764529950029857,15771512438304030316,524288 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,1972826367165741442,11479219942509291453,262144 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:2
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,3554154559859996810,5267812433701029965,524288 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,16961709368688792141,12033648893937128442,2097152 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,808989057125667372,12722925372557052449,2097152 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,1805183073906985366,17935259305307130295,2097152 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,5219311677048041819,1125317725221029965,2097152 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,8416619305243989604,14902661507183157610,524288 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,760541700214189152,5433021558887080503,524288 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,10298217157335369270,17728028523936609723,524288 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,10298217157335369270,17728028523936609723,524288 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,10719411675029824534,3682051189135574889,524288 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,2041318985196399493,12271441129713489707,524288 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,6630067375863837587,3135267608246846195,524288 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,18416683488649200829,16646747421017744511,524288 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=1620 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,7364382478068825275,11545326861667724934,524288 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5240,i,16858017331869882186,1451325659541157021,262144 --field-trial-handle=2968,i,547061048596442642,5511199835629959678,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 87af0e2e105795a3257eca31e8da679e4e3a3ba96c0620d00cbb44149ca14cf8
MD5 dff3155fea44082ec7ac6a2ce769abdf
SHA1 394c2f1a52823252176c02e3a7ccb7d36361d16e
SHA512 bfac48997c38fa3d52a5cb517579d09d76d6b61859cf5ba422eff2981660a1be14b0dce9cf5a6007e983f44e37ffb9215543a3ddd5299a870b41fd19a7746777
TLSH
T19181A8380E6F00B5F3B11FF1B3D14B44347E82EBF993BD9652816A70790A761B2C9405
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589e5e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589e5e.TMP
Size 3KB
SHA256 4f90376e9434e85ace7e81a60b28a6645fc8134eda87a115056f6214cb9aced3
MD5 96838d4d747496e6001a6a5785a4902d
SHA1 0bead6723f472e2ded3ae34ee803ac913849638f
SHA512 9fb9d20c7acc398ab8c2995cb317a330948c7838aab9af8529938b1ec451ce4ca2636bad757ea639c4419f2b1eb5eed3f299dc9f82d4af64fa8de57e9f03a2c1
TLSH
T16281A7380E6F00B5F3B11FF2B7D14B44347E82EBF997BD9A62816A70790A761B2C9404
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 4113fb04f6aa8f489219f3f7d8b029161a810ec63905a919cec9214a661ec82d
MD5 2b0c3ffd4140898b149bd9181219c043
SHA1 f77bb87053d49df70df06c226b924f5af9dcd351
SHA512 7f15948a820a4dc668433d618d9f465343569d713f357ccd1c745ea2db540669edb95b6424295cfd382e0811c4d0eb6b65772732437f6810df9c99593ac3b7ef
TLSH
T137115BF3C3E5856E8E0116F09A24AE1BDE2D0616422C7C1989D4EF6B93E3075D10555B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dc313d974bb0ff86aae795b7203474a24e968d4abe9eb593d069d785fb19a659
MD5 6e83c5238513e32b52b4e76cc5a01c57
SHA1 ee10f45c5e11502143fe664fa6187957da3a0833
SHA512 e5d3efbb6923d94290532f465d1aef2b181063cad9cb9bc0a31fcb89813cea3f7203fbc030abc74fb8dc8013a94f29e5c64e9d17749d5e5f264f5ed288133674
SSDEEP 384:sxZoosPUqGR9/fxFsdIoHQ8jHR+RsE/bHJ/KTCy:sgosPDGR9/fxUIoHLjHR+Rs2bHJ/KTB
TLSH
T17952C751AA386977CCDBD219F955BFA3D6F4047291900E44AAFC9E1C00E6BED2247C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2719cd321eaa2dc7d18bd93d263b27bc4e0d812028eb35555848f2c730320871
MD5 48677de824540e8dca1a3c2f4b040e87
SHA1 ebbf1369451c914aff245d184fa4c28cbec943e2
SHA512 5640a90a1ef58d5090f0c0fa3e920e09b2ad05d853ca1beef23c1f5d70c81544e068e8f0e847449c8fba261d315644a627c02f0b85777107d5d68050d367534a
SSDEEP 384:sxZoosPUMR9/fxFs6WoHQCjHR+RsE/bUJ2KTC9:sgosPxR9/fx7WoHZjHR+Rs2bUJ2KTM
TLSH
T11952C711AA34697BCCDBD219FA55BFA3D6F4047392940E44A9FC9A1C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 47669aaa21efa811f1387bec1244d4d8a38d27dec2e58bdb28ec0eb8cd9b9c7a
MD5 be5baa04ad03371d5c044e9dfb44f4aa
SHA1 c492b97cf84ef22ddbec9d044e37127a8415da84
SHA512 aa9d8e2c1cce8ded1889803c5af8014d02e27e797a3ba2a0a5a66ae374e7b315ec8026ef8c209d86594ef3e7dea7d7860ad98acb5b0f461543fecf73bb55a325
SSDEEP 768:aeRsW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjRSroIyiGYO:D6W7kf0Wvqidau1jaa5LA3jPGO
TLSH
T118D20A3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB7EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3ea2c6c308265410c1507083fc8bc205014f88418d5959e75bb21b8df4db3009
MD5 79299c41b9bd225f1a717ecba3a2cb7b
SHA1 ad34701ad5faec6fc7213a3eff022b0460f437a0
SHA512 fcdd1368630e5e84a4ba0eef6c18ad6c86a8262d40eba255e8a35385d25b19ecd1058d7b974f101564998fd4701ecd770ebaf70617fd7f778da3585a5838e1e6
SSDEEP 96:KIbCKc061e6UccuKMf10auKsb0IuQCa34qv+XeKEcHMwKRr:sCFpXr
TLSH
T173916001707F02013CBE28199666CA765E4271633628A4FF7BB914630EA7E214EFEDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593bf6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593bf6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 056a1010cb46f28940d225dec406cc6eaffc39cdfe95b64b301a86cdaab304fc
MD5 31666ed8cff5e823a094e87bab7a6dcf
SHA1 36fc4b1b477bdbd502c61474706261a9bd9ae1df
SHA512 4b5d5ca485d548145b3cc92535a971481cc55e61bad6cc5328b57b8ee9126297e84fe9e136878cf09c4d6d9c96cda1ad7eb7e7cf47de9f3940cea75c1cd62ab1
SSDEEP 768:M1FQ/j9wg2JutCS5Ug7CjyhNLniTuIJZvn:H/7iT9/
TLSH
T159C23AF248D7883AD9AD9743E77D2E134EBCC027B5859940B3D89A1CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 08464808c896355b54b5c1e856daec071e6e5a508e34a179def53c90a47899cb
MD5 816284358d688dc36ca3d0c9fcdfcf30
SHA1 50391936fd989ac4713263999502b834d1a4f092
SHA512 ed1b1e5a108a285a38cf0b3953ff0052bb55b9ca653b6141385755784824aa0b2b6bfb5f5e15fa3d49e8001445771355fbe2e2abdfcaefebc9e55338a4f6f8ed
SSDEEP 384:UeZcIhsNyj0JhctbmSs2kg7COIdEaACEJraLPPiv7uIJZocn:Uchj4JutCS5kg7CjyhaLniTuIJZvn
TLSH
T167828E319C745C7759B6E241F58A3A175FB84037A7C99E84A5FCEF2C01DBA981307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d979de2e17a47715417f3762348838e48203220c3e602eb4e16b328d9f120666
MD5 6132800566d6c2b64461dc11df6e6ebd
SHA1 3e963dc91e88584706f70fc91b479027a4c7e679
SHA512 03eff239581ee8efd9d540d98603adb5e605e46802998511045a36f7a1b06b07d5821b294cf1559cccfc37fc043be85c2907976fbc46b496d7807da6225455e3
SSDEEP 192:CPONGi64BlfQmiUyowo9Cq5GBPKXo+FdGJaV6FC1SJr6WwLBq0PU6:CPONGi6elhjp9CqTdEaACEJr4LPPU6
TLSH
T1BA122C359864AC2B5EA2B551F4C736135FE4413BEAC96F84E6EC6F1C01EB79C1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 977392cda851b444cf1fb7eacf50ed5f24e580c007ee5f5b8910be9f5ee8238a
MD5 f67bd88dbc72dff35c3c694d5bf7fdfd
SHA1 952e8c87f25515458a2aee364cd3daaf4001e94e
SHA512 cfb083263994fcdf08b4b2112b3c8fc462a755dffc073587a2d51e3bc7495d4e9790b64808d50796bd6ce73c1fc6008387b79963257700534842cf52f250ae7e
SSDEEP 192:MON664BAQmiUyoC1o9W5GBPKXo+FdGJaraDLyhLU6:MON66eAjCe9WTdEaQLULU6
TLSH
T12E02E935AC786C7B9EA2AE45F48737175FD8113BAAC55B84EAE85F1C009764C234382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c7a67e6a9d5c1325a97c0451acecb00687439f6a6c7d45d03490d5350992efb7
MD5 b3af6661ed99f20da425a9fbec968204
SHA1 d1985684c5bdee0753982ad3e7938510311473b8
SHA512 aded235cdfdf9b86b489336d780e243bcef99be2703a04c8fc9881c374863ecae8b88943ccb6e9bb644d09ed66e5a2361ee30f747c7fef67034ca6d638519731
SSDEEP 384:WeZcIhsNyjjJUctbmSs2kg7COIdEaACEJraLPPiv7uIJZocn:WchjvJ3tCS5kg7CjyhaLniTuIJZvn
TLSH
T19F827D319C74AC7759B6E241F58A3A174FB84037A6C9AA84A5FCEF2C01DA6981307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c2c7116-55da-4307-b688-7337b10cdbef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7c2c7116-55da-4307-b688-7337b10cdbef.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bfc389dadacc2912af8da004fc5a129a4e53728a58f5b3ded22d002a746eb75d
MD5 c737c034055c5ac510f0f46591f80c22
SHA1 3d7d40fd333e82f408cdc93765a255eb1ca1c670
SHA512 4fb4507a17ff8e54db56b4f1f62455ab8440755e8a4191c4937f19d14523a23c1f65ab4c1e6f81ea4ed9cbc6948c9fc24de728e92df12ddfb6dd9fc6ffc3d133
TLSH
T160412768BAEA0148B3B77E46ABF6685D447FB9772E07D45D10110E4E0A23A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download