hxxps://link[.]edgepilot[.]com/x/XGFPOkrMhLYXdVz6w8D-hCw?u=hxxps://linkprotect[.]cudasvc[.]com/url?a=https%253a%252f%252ftrackingservice[.]monday[.]com%252ftracker%252flink%253ftoken%253deyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9[.]eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vcHJvdGVjdGlvbi50cmFuc21pdC1pbnZvaWNpbmcud29yay8iLCJlbWFpbElkIjoiY2Q3MjFjNWItNTI4Yy00ZDRmLWJkNTQtOGIyMGY5YmI1MWIyIiwiaWF0IjoxNzg3NjYxNjgyfQ[.]RhBA-CTPto9Hn9L2L4FrKUitVzCDpmjirxcyYLXN65g%2526r%253duse1%26c=E%2C1%2Ca82avAM2wO7PAJPXdOUuMLMpF_nQiN7jj4q3XZkxG4iaMr69Xx_TTaPDrrsPTG060IjZAPrWpdmy3ctlwiovwceLwzMMNoDLUegmdpA7mDfoxOdramHO%26typo=1

Analysis

user interaction
yes
max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://link.edgepilot.com/x/XGFPOkrMhLYXdVz6w8D-hCw?u=https://linkprotect.cudasvc.com/url?a=https%253a%252f%252ftrackingservice.monday.com%252ftracker%252flink%253ftoken%253deyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vcHJvdGVjdGlvbi50cmFuc21pdC1pbnZvaWNpbmcud29yay8iLCJlbWFpbElkIjoiY2Q3MjFjNWItNTI4Yy00ZDRmLWJkNTQtOGIyMGY5YmI1MWIyIiwiaWF0IjoxNzg3NjYxNjgyfQ.RhBA-CTPto9Hn9L2L4FrKUitVzCDpmjirxcyYLXN65g%2526r%253duse1%26c=E%2C1%2Ca82avAM2wO7PAJPXdOUuMLMpF_nQiN7jj4q3XZkxG4iaMr69Xx_TTaPDrrsPTG060IjZAPrWpdmy3ctlwiovwceLwzMMNoDLUegmdpA7mDfoxOdramHO%26typo=1
Sample260825-ttpnvsstcv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3748	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321484812050939"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{82DDDBB7-B51E-46AA-907B-0AECFCF8AB95}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 2056	4956	msedge.exe	85
PID 4956 wrote to memory of 3748	4956	msedge.exe	86
PID 4956 wrote to memory of 1112	4956	msedge.exe	87
PID 4956 wrote to memory of 1112	4956	msedge.exe	87
PID 4956 wrote to memory of 1112	4956	msedge.exe	87
PID 4956 wrote to memory of 4828	4956	msedge.exe	89
PID 4956 wrote to memory of 4828	4956	msedge.exe	89
PID 4956 wrote to memory of 1088	4956	msedge.exe	90
PID 4956 wrote to memory of 1088	4956	msedge.exe	90
PID 4956 wrote to memory of 1088	4956	msedge.exe	90
PID 4956 wrote to memory of 2968	4956	msedge.exe	91
PID 4956 wrote to memory of 2968	4956	msedge.exe	91
PID 4956 wrote to memory of 2968	4956	msedge.exe	91
PID 4956 wrote to memory of 2088	4956	msedge.exe	92
PID 4956 wrote to memory of 2088	4956	msedge.exe	92
PID 4956 wrote to memory of 2088	4956	msedge.exe	92
PID 4956 wrote to memory of 4752	4956	msedge.exe	93
PID 4956 wrote to memory of 4752	4956	msedge.exe	93
PID 4956 wrote to memory of 4752	4956	msedge.exe	93
PID 4956 wrote to memory of 772	4956	msedge.exe	97
PID 4956 wrote to memory of 772	4956	msedge.exe	97
PID 4956 wrote to memory of 4584	4956	msedge.exe	98
PID 4956 wrote to memory of 4584	4956	msedge.exe	98
PID 4956 wrote to memory of 2012	4956	msedge.exe	100
PID 4956 wrote to memory of 2932	4956	msedge.exe	103
PID 4956 wrote to memory of 2932	4956	msedge.exe	103
PID 4956 wrote to memory of 2932	4956	msedge.exe	103
PID 4956 wrote to memory of 2084	4956	msedge.exe	110
PID 4956 wrote to memory of 4024	4956	msedge.exe	111
PID 4956 wrote to memory of 3092	4956	msedge.exe	112
PID 4956 wrote to memory of 1372	4956	msedge.exe	114
PID 4956 wrote to memory of 1372	4956	msedge.exe	114
PID 4956 wrote to memory of 3184	4956	msedge.exe	116
PID 4956 wrote to memory of 3184	4956	msedge.exe	116
PID 4956 wrote to memory of 4824	4956	msedge.exe	117
PID 4956 wrote to memory of 4824	4956	msedge.exe	117
PID 4956 wrote to memory of 2984	4956	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://link.edgepilot.com/x/XGFPOkrMhLYXdVz6w8D-hCw?u=https://linkprotect.cudasvc.com/url?a=https%253a%252f%252ftrackingservice.monday.com%252ftracker%252flink%253ftoken%253deyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vcHJvdGVjdGlvbi50cmFuc21pdC1pbnZvaWNpbmcud29yay8iLCJlbWFpbElkIjoiY2Q3MjFjNWItNTI4Yy00ZDRmLWJkNTQtOGIyMGY5YmI1MWIyIiwiaWF0IjoxNzg3NjYxNjgyfQ.RhBA-CTPto9Hn9L2L4FrKUitVzCDpmjirxcyYLXN65g%2526r%253duse1%26c=E%2C1%2Ca82avAM2wO7PAJPXdOUuMLMpF_nQiN7jj4q3XZkxG4iaMr69Xx_TTaPDrrsPTG060IjZAPrWpdmy3ctlwiovwceLwzMMNoDLUegmdpA7mDfoxOdramHO%26typo=1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffb8646c188,0x7ffb8646c194,0x7ffb8646c1a0
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,3718467850854507515,7610447824342545943,524288 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,18275191348763936833,16894894864215733983,262144 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,15239573413713281065,16284875313726518038,524288 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,14048493743147287346,12700223473662472679,2097152 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,1887162284689614735,10644901670599428613,2097152 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,18291582687543750563,6188254164306881993,2097152 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,4611033971484169603,4592754275738134990,2097152 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,5986624172379684272,14409225296568685921,524288 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,7732250546287075645,3928710659462938598,524288 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,10774319487173499333,1096218736677822944,524288 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,10774319487173499333,1096218736677822944,524288 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6252,i,11995815341445526594,12418145154166159011,2097152 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,414681215757850636,11078167116626103932,524288 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,1390892266814229777,15334276544503075675,524288 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,4773380610287348273,5446208318148066849,524288 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,11488845424492330859,6850561705217696954,524288 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,2305329399735838778,9492148828309025597,524288 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,15090350553400814451,7748449586859327744,524288 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3852,i,13425847030847488307,549870892548795314,262144 --field-trial-handle=2368,i,11921656263246780519,11952022402180097522,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc3cbdc636712cd0ad246adb60e10a6c82511eff5067261c392024fae841e7a9
MD5 c1825e771385238aa2866582788cf8ff
SHA1 cdd34f1c740914ce98dfac6172ecd00fb2da9783
SHA512 33f14925d45545eb4c68af5b5b273b9724142601b0f5098ecd00afa7d2c73115a7bbfbde0f2118a5645868d8b32a69bd2a748d5d5a3d469656956f8af0313fdf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e5a46b939043e44fcecc9e16db3b00c390c663d1bbc7bcf168b435724b9615f5
MD5 345067ecfe34d725792a80d65dff5777
SHA1 83aab4ccae01738c1fd85fefeb08d57595838918
SHA512 bfbfadb0f2f1c9b53577490a0cefd07f6e2d2b82363727ac880bf952137756bdd4d44f95a9972ed0aea71968f732f42b371fc9fa81a645cdaac38477cd3041b1
TLSH
T1A6E026CC09CEC22E9F5CE48753AC530CC380371E93C8ED9F171484C4B4814A0B382A94
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 de545ea4b7203870b10489280f6758c616d8a01eb164bc005124ab96eaba837d
MD5 b357f15be1c88e88bc320126221ec286
SHA1 f96c7d4f770a8c6249d1484ce6b8a81a7684eb8b
SHA512 7a934e18ea971d87d31be47d4b9ba5b71fa075ab8ac4ad7c999070ef8941c903f80dc237a459515bc0c9d7a71726ecafe6ff69cc2f520a0e6d244fcbd326670a
TLSH
T18271E70503954991EFAED2F3FEF91005F663D6892D0BFD65228068FC1C16760A92ECBB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585c44.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585c44.TMP
Size 3KB
SHA256 9763bdf9e9750f304fe4435cdf7f7a16135e254d4d357f69bf8821c90ca64cee
MD5 fbf3b1b3a5072423ffee8d169a3f183f
SHA1 158a3d3ed10e5c150efb144f72cca2b84d232a43
SHA512 7cc04cce07325fabd089845c4ab45a78b4016332975bd10f86f8da9942a7c57a483091f0cbe74a9a275d5f48937c594a413f27c6d55d2a3b76ea3bcd5018173d
TLSH
T1E071E70503954991EFAED2F3FEE91105F663D6892D0BFD65228068FC1C16760A92ECFB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d00d494743609f01aaa539ad480fff21997f6487e32219b63325ad3f5ebad8ed
MD5 beaf3582429555c1cbd421f1cd3df182
SHA1 1fea7ba1208b49d4c0a5145e2cc008cbcf1b7919
SHA512 0ce3931ecb72cb31ed65d56c356ebf4554e15c83d74781a674f8f394d1b1f293a77b2d5adab819697cc2a1ea12796624a6b84e63d85c7303d91c8cc9249c1c97
TLSH
T15571FEF387E5C56DCB0156F09A247F2BEE1D0A24835C3C2A89D4AF0BE7E2872D04565B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 63401b0917d6e33a5fbc39e0ddf054c5d85bd9b4f053c01b7393e2fd48e891ca
MD5 afb0ae95f7ba6dd7746198ef01fb310a
SHA1 b95417a03c4a67c358c7cdfca8425ad57d0634db
SHA512 348ff6a314315636f3ce3158d6ad7f3d568f3d46983c221298536964b988811ec4eb36892443bd6a1b9bf423b42880945e5e086ca439c24819d2772d795af35a
SSDEEP 192:sxZjR1yM/jK1Ml8Mkl/fOsZqXIdpUENHW6+WNqFhu/YLIZdxIgrJ:sxZjrMl/fOsZq4jHbt/H9
TLSH
T1825208166B386977CCDBD209FA50BB53D6F5046292945E44AAFCC91C00E2BEC220B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 41d9a189c1b910ef447e6b0382b630748c0a8c583cb151ef2afc75bb326ec265
MD5 e611a6b78b38a8991baacda0765c3213
SHA1 f65f4e32ee90f1a64c9df7866a01741ad332eb00
SHA512 c2da2d9ab9b81a75f8353a31d0f15f649008d778e7b508ae724ff097b10835a4955680c52da99eadf93707fae386677d974be7bc35539980f7ff6279975ddb98
SSDEEP 192:sxZjR1yM/jK1Ml8UQ60kl/fOsueXIdp6ENHW6+WNqke1Nhu/YLuoaxIg5nkKJ:sxZjrq6Pl/fOsue4BHbgW/lt
TLSH
T1E062F8166A385977CCDBD209FA55BB53E6F5047292945E44AAFCCE1C00E2BED220B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6ddb5788094433dab16effbe1a3173f220cbe3f90489eebc8d7bbf7bf1e25872
MD5 1fcdd0ee169d4b57b292e359e7c8cd55
SHA1 7beab364ffa0ae43bd2605a8c3e2478303e975a8
SHA512 cbb1f6cced4b0a5c03e24b7fc5e0264d53889f87227cbf49609f8d1db9322a7986ddecbf7838381473a52aa48fa16cbe5f4123c8f7cb73d9e3900a233e19e55f
SSDEEP 768:BJs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNDroYv:BJs6pD1WvxzWju1jahILIsNwYv
TLSH
T1B6D2EA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 eb92fca8bcf32946bfc36a17ce29a4d95097095388fc326ccbe374cbb70776ec
MD5 7f9cc9397389ca7d6dcf27fb2ef07c99
SHA1 bf079d45b24598032b7f5b01e60be0017d24e801
SHA512 3f433b845e852f3899d6447f9c1b1fb4156acd7ae31131f071e6c5869a227300c980fc4bdca6b80a1992133c7bc42de29fa9c8176424734afd98ff33bbbc1891
SSDEEP 96:KUAAKtePevCKoUOKhCKqkRgIKZumioQKV+Z:iihpFpPza
TLSH
T1D3E1E22276B703522C7E2B1892D5C7278A43B553751CA42B3BEE40B58DA6D204DFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24675bc2-96fe-46c0-9a1b-b1b6b926957f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\24675bc2-96fe-46c0-9a1b-b1b6b926957f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c98583297e8ee9cfbdcfb10da740c83856b8865678b3b70319fc6fe7adb61d60
MD5 86dce91b35fd1c4501f4f96fffcd42b5
SHA1 13517a69262e2f1862118e61d9094a1287e4fbd9
SHA512 188bc16b459d691e4af89b1d5bdd73406af0315cd765533a58278b1d7ce624d8b46866f6b0f8896f33660f889ed0ba843f4ab268b62b6d44b042a7a86529088d
SSDEEP 192:u//m+xasuheOwQxMGsNKIQqN77+3vX4QmiU1yHn4atb0qO2bo8P+OLM/qJet4/tg:VZcIhsNKIYoK4a9HON8P+3HivIueoG
TLSH
T1FE826C756D785C761DF6E185FA8635078FB84067D6CAAE80D4ECDF2C00EAAAC130791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 16cfdca55fb539340e63e34c700c8177d2be1d161588bfb90752f834be67e7e7
MD5 d6eec434fbcc112ab25bb7b8fd853da5
SHA1 041032698205dbf853b9913926aedc991fd3869d
SHA512 999895f9d6d92d138e9cf95c455b36d3965738a3344f82b9f4f235d332451840c84a945cc00a986d27755036e32311e73058d61ca616dca6298590b1b3ea4e38
SSDEEP 384:diFiZcIlsNS8TUNTUlIllYoW4a9HON8P+MHivIueoG:UFQlDwg+h9ON8PVHiQueF
TLSH
T189C218F258D78836D9AD9743FB7D2D038E7CC063B585AA40B3989A1CCC965BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c30532b116242247bf91e52aad2abcd681c5803b76b3cff6d3b960c4d5ddeef1
MD5 f3c5d429dbbebf918ae5e789a22647a5
SHA1 5c1c14971a7bc055415e04e316f919801c2c097f
SHA512 a8b9463d4f584aac3ec896b69980e9abe7062f514c2ff4681a3976fec4595c21ead764a1d2563c5868763cc119fdbca87cb7c9c9ea0c15849bbac16d58d8bed8
SSDEEP 192:qONF6O7+3hQmiUy57Gttb0qO2bo81gGgSU6:qONF61+Gt9HON8FnU6
TLSH
T13102E9356C686CB75EF2AE49F98737179FA8103BE9962F40D6E85E0C00D765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aff3811e69133b55342a23ce4d5e71b5113dd96e61c820612c8e32289249dbff
MD5 2cfb91587c8a0c1741b7067fc45876cb
SHA1 97fb976bf22c0445dc399795d4ddcdbd165951f6
SHA512 8e2916e20d23d9ee1790d625e15e6c4815325e40fa157e60d4d964320897776adf14a0f59051a215db52e76ff553e30285d279136ecd4b6692573df871e4651d
SSDEEP 192:LONj6O7+3YQmiUyX7Ittb0qO2bo8P+ycN/qJeU6:LONj6COIt9HON8P+rHU6
TLSH
T195122B35786CAC775EE2A541F98731178FA94137EA8A7F80D5DC6E0C01EFA6C234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 beda7bab5d5d50f8d05d88784381a547bcaf4faaba5625eabe512aaeaa382fe9
MD5 0b6eeefc869f6810e6fbc9a0dfc98284
SHA1 1d526f763b5d6730ef4bfd85af767da5af2c29e1
SHA512 1903d8147ad2925b50d1cf9688700f15f9773a31c068a11206997ff828856ec85908be41e6aeb6f092ee1c1f740715a99f57f26fcefe568d077963a84c474c83
SSDEEP 192:u+/m+xasuheOwQxMGsNKlQqN77+3vX4QmiU1yHn4atb0qO2bo8P+OLM/qJet4/tg:SZcIhsNKlYoK4a9HON8P+3HivIueoG
TLSH
T108826D756D785C761DF6E185FA8635078F784067D6CAAF80D4ECDF1C00EAAAC130791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59b9e208-cc9a-4af9-8151-bcf4bb3c6a4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\59b9e208-cc9a-4af9-8151-bcf4bb3c6a4a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ee8db4390d1e8f453996ce082541d9a53a6951f8348c149a24d55bc705afeaf3
MD5 dfd9ea971ebf0898fb1920ce0fa6c4b9
SHA1 53d3d2a042ca13e858ffb1a0b7300c1b8c443e3f
SHA512 970996e962bbfc069d1753b11c374fec613ce5097f3789374e9ded999d38092fb9bd94c9765e007a3f9c3585930cc848ac23eb8ffce5584ce24a626736a3e5cf
TLSH
T13241F859A7E90104B3B36F56AFF6A86D587E7C772F0AD45E00050E4E4A63B40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download