da00ed37d92e5857e6a9796a2c01ef05ff1e2d84475c5c8478d1166526edf14b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
extension-fix-TY4TYU.html
Size 5KB
Sample260826-pptpssdp2s
SHA256 da00ed37d92e5857e6a9796a2c01ef05ff1e2d84475c5c8478d1166526edf14b
MD5 c71a6a07ff45571ba1aabdbd31646827
SHA1 0d981b82854f6d386f3dabb06da3630f78eec336
SHA512 c5e78e047f731b085453fa178af74c1fc6aa97d9a740e515f29b928a3c8a06c95d0a5c131c305f413022257b8f79b305d46b4e2abc03735cb5614c0fc4a706a7
SSDEEP 96:fjFj7jOjEDDK/D5DMFLzLexWA3FSreZNeBu57RslvaQxvbzM:fjFj7jOjEHK/VoPyookeZyu57qlCejzM
TLSH
T1C7B1C572F9BD117F2093926262BCA70A7AA0C143DB9609903AFCC2715F8EF45E9072C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1724	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322210509985310"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{A63CFC6F-E4EB-4924-8B95-1064264A4488}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1956	2100	msedge.exe	83
PID 2100 wrote to memory of 1724	2100	msedge.exe	84
PID 2100 wrote to memory of 3592	2100	msedge.exe	85
PID 2100 wrote to memory of 3592	2100	msedge.exe	85
PID 2100 wrote to memory of 3592	2100	msedge.exe	85
PID 2100 wrote to memory of 3772	2100	msedge.exe	86
PID 2100 wrote to memory of 3772	2100	msedge.exe	86
PID 2100 wrote to memory of 1948	2100	msedge.exe	88
PID 2100 wrote to memory of 1948	2100	msedge.exe	88
PID 2100 wrote to memory of 2760	2100	msedge.exe	89
PID 2100 wrote to memory of 1948	2100	msedge.exe	88
PID 2100 wrote to memory of 2760	2100	msedge.exe	89
PID 2100 wrote to memory of 2760	2100	msedge.exe	89
PID 2100 wrote to memory of 1040	2100	msedge.exe	90
PID 2100 wrote to memory of 3344	2100	msedge.exe	91
PID 2100 wrote to memory of 1040	2100	msedge.exe	90
PID 2100 wrote to memory of 1040	2100	msedge.exe	90
PID 2100 wrote to memory of 3344	2100	msedge.exe	91
PID 2100 wrote to memory of 3344	2100	msedge.exe	91
PID 2100 wrote to memory of 4456	2100	msedge.exe	94
PID 2100 wrote to memory of 4456	2100	msedge.exe	94
PID 2100 wrote to memory of 4456	2100	msedge.exe	94
PID 2100 wrote to memory of 4012	2100	msedge.exe	95
PID 2100 wrote to memory of 4012	2100	msedge.exe	95
PID 2100 wrote to memory of 4012	2100	msedge.exe	95
PID 2100 wrote to memory of 3040	2100	msedge.exe	97
PID 2100 wrote to memory of 4524	2100	msedge.exe	98
PID 2100 wrote to memory of 3040	2100	msedge.exe	97
PID 2100 wrote to memory of 4524	2100	msedge.exe	98
PID 2100 wrote to memory of 2080	2100	msedge.exe	100
PID 2100 wrote to memory of 4884	2100	msedge.exe	109
PID 2100 wrote to memory of 4384	2100	msedge.exe	110
PID 2100 wrote to memory of 1116	2100	msedge.exe	111
PID 2100 wrote to memory of 4364	2100	msedge.exe	112
PID 2100 wrote to memory of 4364	2100	msedge.exe	112
PID 2100 wrote to memory of 4844	2100	msedge.exe	114
PID 2100 wrote to memory of 4844	2100	msedge.exe	114
PID 2100 wrote to memory of 1760	2100	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\extension-fix-TY4TYU.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffe8275c188,0x7ffe8275c194,0x7ffe8275c1a0
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,9767726129502377530,4462224088918460500,524288 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,12076316750980725919,291077054390929871,262144 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,1742808756075969171,6620283771717342619,524288 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,2736305063714144754,5955476735923735920,2097152 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,11507802970717883168,18353573612277338870,2097152 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,1146136343598665622,14063426963547426443,2097152 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,2710361243609888075,3237540174048119650,2097152 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4760,i,2519170882132513638,7429182880154836055,2097152 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5260,i,11006050542910726126,13379412626524938641,2097152 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,4368758678101723971,13842120701077512368,524288 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,8555791847144958685,16787815660690793122,524288 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,14376948384191357521,10740020747865323110,524288 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,14376948384191357521,10740020747865323110,524288 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,14061327988591361742,3347496235580952070,524288 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,17209695083560504040,7240082280749340212,524288 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,16465502107383609865,17314914806017307592,524288 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1004,i,9336407153065919332,10992977166982420688,524288 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,18292901298917385231,11629356434657833971,524288 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6608,i,594987159640344205,5298790040579458757,262144 --field-trial-handle=2292,i,1107074686428697895,4331178144642248148,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 35b8595ae11a60baf5af19c885f013ddd223bb09ff4019ae1a136ea9f5fa40a0
MD5 56ac8d7674e45dc449baaf533d6c937d
SHA1 1e62a8df4dfd2a09d2d90ab3fe4376e2c6455323
SHA512 7b53e55a2402dec3659622888c6dcec6f6c5c412db3b1567d36a1f5e41a42dea9d5487d13ee1a3f6305401d27a4c82c6440bc50558941cf7e11e465e3b360843
TLSH
T1E8616DB0090FA7B9F30A50F153D21195343288EEFD432F34536AA8FA1EA430391D9F9A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25bbd94b-7a8a-4005-9c79-67b488d34aff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\25bbd94b-7a8a-4005-9c79-67b488d34aff.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 710ba7c9ce4b95742aa0c60bd46380963839cfcbac51e8fac747f27e4719197b
MD5 e1bd586e620852f95d02b58d36a33f3f
SHA1 d5b25712b4930cdc0b206eb78c8a79224437a071
SHA512 202dbf87236090589c68b3615e893fd8eec4223bcfb953d7716280d4c473dfc528021108677e9be88aae38147391c4b09a8eaab0fd1fabf8cf1f7fc6ae1c64e7
TLSH
T1E231AFB2C6D587AE881157F05B24AE2BDD2D060A422C3C668EE5FF1F97F21B1D10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7e4426244b1508829bd741a187c0629b2b11beba9b88ae9c9b411a53ef11c6db
MD5 a44a793b8711bbce40fb9b8e185d5f19
SHA1 0815c7b0aa59c992782bb8f4d4058a443eeb7e1f
SHA512 fcf33c075c472068a9753cae4203e43321793a8dce423b3368a8954296a57b903c30f040f01433ffd2eb96385cde823b3f3d0fcc407255ce77418ebadc6a2145
SSDEEP 192:sxZbRRkC/fXsYENIyIdpd4HW6+WNGYIk2qVIgrJ:sxZbcC/fXsYEG7iHbGc9
TLSH
T16122B8116E78A83B8CC7D21DFA55BF53D2F95032A1D11E58A6FC9A1C05E76DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f6f03f2da4a91153fe02a634e27463382a2ef281f2d05a85a978bb571766594b
MD5 c509e70e2a2f0ccfd5f4f23be36284b2
SHA1 6da3e03036512d170ff4b63e4e5a2323c3c40505
SHA512 aad03b3e3b23879149e34b4e2bf3265fbcbe0230a85de644c82e9c71fd45e59e93448c5469a888548c8b1829755b7f3921b3c8c2ae1499efee2c58a7be931d32
SSDEEP 192:sxZbRRkC/fXseENIyIdpd4HW6+WNGYIk2qVIg5uJ:sxZbcC/fXseEG7iHbGcE
TLSH
T1EB22B7116E78A83B8CC7D219FA55BF53D2F9503291D11E98A6FC9A1C09E76DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 64f1c891556764d3968dd33a605ad6ccb05c66ee52988c33cd17a389f1f3748f
MD5 185303e1a9b6096e8991154fbfbbe123
SHA1 48082ca6ccf25d0e8de15a24fcbc8107a7a43f78
SHA512 26c106e2b6d2dd3e29979fb45f62924bd3e98710e3f2b3d1df3c0231683861632a0ce2c8ad135059f05f12f71e41c274468b74f6b862fddef295212542e09184
SSDEEP 192:sxZbRRkC/fXseENB6yIdpd4HW6+WNGYIzyqVIg5EJ:sxZbcC/fXseEC7iHbGRu
TLSH
T12422C8116E68687B8CC7E21DFB55BF53E2F9503291D11E48A6FC9A1C05E7ADD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 94166afeb48e43a758535761c670bd59c2f9cd2105e4875ba9da6a9c4b93a039
MD5 827bd487feef678dac8772cd8c10d419
SHA1 ce955180b5457a0c919ba314bdf598f3e6921c7e
SHA512 b1a0089ae819395bc1b600f63a8142c2c43bd3f6161b30fa8d42471590dfe5957675aaf12f8e4a1724722bc614fc91f6cceb3d97144b922d991de733c6f2a072
SSDEEP 768:XayqbblWvJDbT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7kroCoV:XayqbblWvJDbTu1jah4LAs7vCo
TLSH
T1AEC2093B654CCB7E4FC00A9DDD5A6FD73E9802CBA6588D4047FA994C02C77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4a83ac55cd845db97f9d67d228d9f1f44641f99169ea797a00676f89d8a1a08e
MD5 fd7de4bebdd7f263f0454683806fd5db
SHA1 de54e60bc24e64020bd94fdbef4f7d5d0346d75f
SHA512 0bcbfd9ce9fe5e520f7147d09b098d0a171127332dea1e5c0d16d0648a217a597c5e76ea17fc19bf2974ab5201d4919168b061e62115165d0713a75febec3f37
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyskHQE6SC2cS99IrE2KKTCm22smNFWkg:KYbaKYIKmdCK+wSOneK8U/z
TLSH
T1B091141A727A0293393E2858B26685760F4232633459E5AF3F7944750EABE134CFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66493a6e-ad49-4c41-be20-67968c83f39c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\66493a6e-ad49-4c41-be20-67968c83f39c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e318ba78351f5a60e9a739a26889a7bbeecbab91f15b4f1030ff32b6ccd7d0fb
MD5 b5e0ab5b762806e1229d7e3d0399719e
SHA1 a1958c7084eb2f31e121d51d86aa46ed273df29a
SHA512 039d6972051882c0a48a22007821a17e6baa9e93590e270f528c2fb98c47dab5026879f38b2f6a90fa82358b6a8eff0fd82aa6a05c12b2f24cfda27889434169
SSDEEP 192:uTLsNSEQg2qkRbA7iKQmiU1S0Qn4VRNuOmYx2j9eVX/SR2q6FgU8:WsNSEv2lbAOGIJ4VRNuOPxQ9eVXO2gU8
TLSH
T17D320936BD386C775EE2A545F48736139EA8506BEA893F80C5DC5F0C02DB69C230F926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 fc7f103844641c57f2e79640504b04798f61df0ca91e90df1c0f88e95fe5af4f
MD5 04bfbb4541c7e2b5a1787945951d4c0e
SHA1 2859c3d5f2339cf1ea32154eb68900ad5d391ab8
SHA512 b03968d2f265417b55f37d27bf2bb4d319b164473b79ed6e781616a1e06e35ca29885bc5b6262a80a13b98d615c28a898f562921cea275218a993ad12407cddc
SSDEEP 384:5iFiZcIdsNq8TUNTUlIldv2lbAOGIJ4VRNuOPxQ9eVAy2g+LBNj5xMo0:QFQdzwgHVORJuHuOS9eVAyvWN5i/
TLSH
T1FEA25C739C689C7B6DF69A45F94B22035EB480B7D9C5BE80D6D85F0D029B5EC130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e2d20b5279f71cd844b461c05a64d2e2784ccd1e80b6c085f57df99d9e8c75ae
MD5 f01bf4c7d5be04dbf5b9679b449ec829
SHA1 f3cc90c29d6899ade1eb809569946946731cf87c
SHA512 53ce94429862ceda3eb9734b8983ba2f29b60ec5fff04adc8710434348a40d1d530d474966867b1dc7f7ad120117a7b33ed79cb6b4e3710351c5d6b9de4ec7a1
SSDEEP 384:VZcIhsNSdv2lbAOGIJ4VRNuOPxQ9eVXO2g+LBNj5xMo0:thTVORJuHuOS9eVXOvWN5i/
TLSH
T186827D72AC785C771CE6A545F94B26035FB8907BE6C97F80C5DC9F0D06DA6A8230F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3dc151e5b036cee66f71a3bcb94d4f5346ebda3cad5acebc14d67a35ab3094b8
MD5 d273e69628bad78f7801faf469c0459c
SHA1 940d8670a48cd96129b5fada447883b57baffa9c
SHA512 6845d3b376068f989666042411866fd3532f883e4d7efb22df1d4412bfe58be15b724470fb87a02c447fc936679e2a70cca3d6c475b55f304db11601767591c7
SSDEEP 192:PONr6JkR9QmiUykMRI+RNuOmYx2j9eVpVc2q6FgU6:PONr6U7VyI+RNuOPxQ9eV02gU6
TLSH
T17412F83679786C775DE26845F88736035EA9512BEA897F80C5DC1F1C02EFA9C230E866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b174688a389c4f6d7b263a3ff9f5a87b75d715e2bbccd66b70fb09a1ab980469
MD5 cfbcd5c0bc126e0707ef070881ef8096
SHA1 8bdce5cdeace844414548acd18b9541d6ec73798
SHA512 9ac36deb04592e1f573d014e0727ab3bb4d22e80f45abfd10125065c504d700e9eb7f7f9928bcb83e3c776fbd525cffa998b8ec78958cf305c766d59282587a0
SSDEEP 192:tONW6JkRtQmiUyzRW+RNuOmYxBh3oRTU6:tONW6UrKW+RNuOPxb4U6
TLSH
T1F602D8357D382C7B9EE26D49B98B27135FA5207BF9956F80DAD81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63eb90be-ce85-4e2f-a10c-a124041409d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\63eb90be-ce85-4e2f-a10c-a124041409d5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 807968e3a933c18091730d44746aa0da558d02132f310da45e888715053683de
MD5 5b4e10ddc99353556ee952c71cbf45c7
SHA1 43668bcd0ff8c01055f5ed1d375331e508deab61
SHA512 fe5a73c2de5bada4aa8aea37969953fa471397af0c1d1a6d7b100ab3c4cf9ef03758b0ca761dd022287d9c798b28bf61b938928b46ba718bd18adac6a3354652
TLSH
T1FD415A5CA6FA1148B3B36F56ABF768AE443BB8772E46D55D10010D4F0667B01C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download