46465dbda04c21fe94f223555aaed8b7bdede86c196d44d1b69cb1020c6620db

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resume.html
Size 744B
Sample260905-allgpaba36
SHA256 46465dbda04c21fe94f223555aaed8b7bdede86c196d44d1b69cb1020c6620db
MD5 b480f34cfe31471412d7675e5f996e4e
SHA1 e7274968fa8e643fb7c40632a61d313e8f0c0eaa
SHA512 03ddd15cbad076145429d69bd9e43598a7e4b9d29411a13a59043bbafcc07c411df03cae0420b0a36bf305c65c31824b609604c84a05a287871b8f035b825986
TLSH
T16F019793BC000C0ACB367081FEE57AEC14617085D069FD96BBF1982C89E0323B56274E
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery link pdf

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com
13	raw.githubusercontent.com

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral1/files/0x000400000001e6e3-58.dat	pdf_with_link_action

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3928	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330412304997662"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{0D61B3E6-05D5-47D8-BD31-9568EDD4BE6A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 312	4928	msedge.exe	86
PID 4928 wrote to memory of 3928	4928	msedge.exe	87
PID 4928 wrote to memory of 4892	4928	msedge.exe	88
PID 4928 wrote to memory of 4892	4928	msedge.exe	88
PID 4928 wrote to memory of 4892	4928	msedge.exe	88
PID 4928 wrote to memory of 1524	4928	msedge.exe	89
PID 4928 wrote to memory of 1524	4928	msedge.exe	89
PID 4928 wrote to memory of 1860	4928	msedge.exe	90
PID 4928 wrote to memory of 1860	4928	msedge.exe	90
PID 4928 wrote to memory of 1860	4928	msedge.exe	90
PID 4928 wrote to memory of 548	4928	msedge.exe	91
PID 4928 wrote to memory of 548	4928	msedge.exe	91
PID 4928 wrote to memory of 548	4928	msedge.exe	91
PID 4928 wrote to memory of 4956	4928	msedge.exe	92
PID 4928 wrote to memory of 3256	4928	msedge.exe	93
PID 4928 wrote to memory of 4956	4928	msedge.exe	92
PID 4928 wrote to memory of 4956	4928	msedge.exe	92
PID 4928 wrote to memory of 3256	4928	msedge.exe	93
PID 4928 wrote to memory of 3256	4928	msedge.exe	93
PID 4928 wrote to memory of 2116	4928	msedge.exe	95
PID 4928 wrote to memory of 2116	4928	msedge.exe	95
PID 4928 wrote to memory of 2116	4928	msedge.exe	95
PID 4928 wrote to memory of 3264	4928	msedge.exe	97
PID 4928 wrote to memory of 3264	4928	msedge.exe	97
PID 4928 wrote to memory of 2332	4928	msedge.exe	98
PID 4928 wrote to memory of 2332	4928	msedge.exe	98
PID 4928 wrote to memory of 2332	4928	msedge.exe	98
PID 4928 wrote to memory of 3964	4928	msedge.exe	99
PID 4928 wrote to memory of 4192	4928	msedge.exe	102
PID 4928 wrote to memory of 3724	4928	msedge.exe	103
PID 4928 wrote to memory of 4192	4928	msedge.exe	102
PID 4928 wrote to memory of 3724	4928	msedge.exe	103
PID 4928 wrote to memory of 4100	4928	msedge.exe	105
PID 4928 wrote to memory of 756	4928	msedge.exe	110
PID 4928 wrote to memory of 1128	4928	msedge.exe	111
PID 4928 wrote to memory of 4612	4928	msedge.exe	112
PID 4928 wrote to memory of 2056	4928	msedge.exe	113
PID 4928 wrote to memory of 2056	4928	msedge.exe	113
PID 4928 wrote to memory of 2044	4928	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resume.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffcaaaac188,0x7ffcaaaac194,0x7ffcaaaac1a0
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,8118037487118328897,5865358795489582987,524288 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,4603003968474039863,13679220345364641285,262144 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,15193588100041578485,7621698891278624861,524288 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,2417955340845150836,8477045440909921013,2097152 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,14616038371605776687,95450673475423847,2097152 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,10744063204851010060,5043184928269944781,2097152 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,10055264945780375437,9333533246130027847,2097152 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5076,i,7656668751479072898,17076938516352162845,2097152 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,18120227616907301670,13158095998349279951,524288 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5324,i,13628212381520217077,9596853627408064684,2097152 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,9922248598807986827,14045426838612440828,524288 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,9919690601060469297,17040356485396376747,524288 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,14898621165908000466,6984279442185546017,524288 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,9679889116686500203,5810664102140301481,524288 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,9679889116686500203,5810664102140301481,524288 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,578182734495111779,15675198028230204557,524288 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,15353564469233535174,7866732967040409220,524288 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,10277972875949246962,3611663326413215365,524288 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,4371173373187109949,8965617154403422525,524288 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6668,i,15560915456813493431,9968769935357896351,262144 --field-trial-handle=2272,i,6443033737927923594,17060206437080548064,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1d846382e0381ee9dc97bd93ae9bc8af42a864fbeb897de27a9e4c51ffc53c2f
MD5 ae72418b50de558d786700dc32d45f56
SHA1 5e8875f4b916501cbbc04e6dc08def195eacfb4a
SHA512 53868183b713f51a24053275ac40381b685278deb4242faf0275b364af9501fe0db6953e793ae027c9b3aa9dd6d90fa028bac18dc0de6899e04b51872b40f04f
TLSH
T1DE61E7BD0582EDF6E3D13A3190C03A8738F190E8FD63FD1D01E348B5640AB114A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588c2e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588c2e.TMP
Size 3KB
SHA256 03f45e0f8f3a96ac019cb7864510e9855fc58d3d6d2bd565d50d875b0537f249
MD5 eae5d2e4cc44e727f6c41b35ffc0ea98
SHA1 23b807f8da3e09e5990025dd30ccdb1b1a4b6206
SHA512 f8442fce74dc997ac6b0bdfebf0705778ea7ef029081096cad3c42cd38f14b1a3705178a897e6594b997521ed1ad2b80c31ac28582c638a35cec4523087620de
TLSH
T1C561C3BE0582EDF6E3D13A3190C03A8738F190E8F823FD1D01E348B5640AB114A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8fc933c59702c563626f6145c1fd8a8955f8c8e7c713f766d26139652e4873f4
MD5 86c5fc8f6b502e32adffecd49d83d25b
SHA1 e0f931b3a5694f8e8f2ae2c779063b3e52c9fd35
SHA512 9a67131c5526bb42055792312729a05dc6975c010f70d485e8c14c9bf013e94e4e2e2a1356ee66649a58591d178716cc6054de205fb43cff81c2ef018b4fb72b
TLSH
T1A111DDF387E186AE8A1156F05A24AE2BCE2C0515832C7C1985E4FF27D3E3075E001A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 abaaccbd393ce1e12aa73168eb71ab3e80026870ca2857bf6afa009a5237aaf3
MD5 c0a137bc905d12e8d74cdd012e5f631b
SHA1 b6ba0ca25eb25a568233a870ed360defc289181f
SHA512 f522c5fa4c4b9ef1a596dd06def3f3d31b51d28d304c284824654ca593c8d3cd0ace9c0d5f707319730252cc422885bde7488ec18ff36547b28e1e73092b8ec1
SSDEEP 192:sxZqRAyM/jK1Ml8M9J/fFs3niPIdpd9HW6+WNGY9IKTGXIgrJ:sxZqm1J/fFs3n3fHbGZ9
TLSH
T13F42F812AA346977CCDBD209FA557F53D6F9557292900E48A9FCCA0C05E6BEC2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 39dfa2d1e11f9c0d90edd3ef4492a4f0c170bd5f3ea2ff9dce08a75d81bbc408
MD5 44fc50e0d993bc4e4e55c50b5bcfcd81
SHA1 1033c57549969dd1462413f6a376142a4f488ad9
SHA512 915667689584698f7d0d8164723abcffa569d5924628d52b1e9b847d1f9e8d08c0e57073b6e622756830ce0c1f40d6e782b465d10d14f727b2939d7bec54526a
SSDEEP 192:sxZqRAyM/jK1Ml8UQA9J/fFssPiPIdpH9HW6+WNGY9IVqGXIg5/J:sxZqmq2J/fFssP3dHbGZL
TLSH
T1EA52F712AA386977CCDBD20DFA457F53D6F4547292910E48A9FCCA1C05E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cc1fcfc51fb5033c43f7510e3f9c1afa5990d952fbb6045632dd4f6792c235e9
MD5 45934bf7fa85828d79a108507e83b00e
SHA1 62680dbf54821090a192cbd133385541a566a497
SHA512 4fe633d274c7ca6693ce24e8d9c604aace9abf6a68ebcdac2eeb14aa1da2355da423d14a0f0098ff4afa1b7535390a3d1e3083e3e0f7625b16cae9a8ec7377be
SSDEEP 768:3Ycv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNXroGg6d:3Ycv21wWvu+Z+u1jaeFLeRNEGN
TLSH
T179D20B2B280CCB7E4F841E9CED2AAF866DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9b80c98dce30dae87dbd092fc45ebe9fcb2cedb7d5c83c8dae01f8e0f9ef4758
MD5 2298e0e3a7da651103f64bf8f38e2ccf
SHA1 8cf700125efd3931e807b33f012220d2512ef6cc
SHA512 5a77b4a20af3aa26cbbe5c2249438bfc9629904419a3d13d3b4c379932870a8066eb494865043fd665d676f92d119893b793206eaefa5f678316bd53069ba3bc
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTyamhyKSUm+zq:mTfHhxd
TLSH
T1DDA1BB11703A1346387E284DA365962B5E4175677518EABF7F7800928F27E25ACFCCEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 282104f9a2a758facd195e2b54bdf9774a0da4b41eb64cabbbaf4bac40c465fa
MD5 269a772948a3cbd19de550dc294ae302
SHA1 e2f912f05cb2bfb0acb2b9f57469a4d5599d6817
SHA512 5ad5e7ec7e2ce87d995ae03d3e530782a510e19292e2f2753f889aed68d6da54b8a7bf0c88ad91e1d66d3d43670f449837709ce63985a9c35c4dfbc4b82efa85
SSDEEP 384:TZcI9sNSZ/6ziyXve+CXOmep3JrJ2b7O6R2Feoz2oF:L9GTWvO9p3hJ2b7TRJm
TLSH
T1D9828D7268384C765AFBD186F5473A139EBC5067D6CA2F80E4EC6F1D05DBB98230AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d1b6dd26ea7a83db51c03e907d2c4ee1949c9f776f6703f6a3420580504bcdd8
MD5 b4396efca90d7e6e4b5b6294053fbe59
SHA1 0128162b827815e5a093061fd156e1d659012c1e
SHA512 59e5a60e874d2b310e8869ddb767d987ead043ff2bf5bf4ca917a8587fbcd65e5b2bea450b820bf141a9e384f631ff151a5fa25ef97e3530735f616170ea5dab
SSDEEP 192:JONO6v+YLNQmiUyvKZh+CG6Om9oEusnlU6:JONO6vz/zZh+CXOme6lU6
TLSH
T17602D935BD281C7B9FB25E45F9873B275FA8217BE9952F80D9E81E0C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c2ff9c9e97a9661fa3d045d09e9c5366e121fcfd45470be7bb1719b0b9cdf981
MD5 c0f309ddb751b290ed33f41b8049e3ea
SHA1 e124fa58934ee71e01d032e0ae4656c66083fe8d
SHA512 16e388ae0533d6f5a5b1c1649e7ef2d0f01a63a3c59887795adcf8a9d7e42e4964ea095368ff0a07e1f495af81ff3632e8631b980e87adf420e2073ff04ef0b5
SSDEEP 384:HZcIhsNSZ/6ziyXve+CXOmep3JrE2b7O6R2Feoz2oF:vhGTWvO9p3hE2b7TRJm
TLSH
T1B4828E7268384C765ABBD196F5473A139FF89067D6CA2B80D4EC7F1D05DBB98230AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ea83b7ecea822befc0afd6c6cf3c3160360cf35eb7b627108aae5251e981e346
MD5 e8faa554c0b477dab6d673b15c9675d3
SHA1 b50c659e9735f986f7ebdccee8b8954574320b35
SHA512 8e61b1168cf7d1b78dd293dcf951c7f75549cd0caafc157f5df9f3c366e505599fd3a5aa7f0b63d05bd77b1aae7615218963956033ada0804f6e7045c09e1df6
SSDEEP 192:3ON76v+YL0QmiUylKth+CG6Om9opwSJrHeCH2bqsU6:3ON76vzItth+CXOmep3Jr/2bU6
TLSH
T114123C36B8285C7B5EE2A595F48735539EA85127DA463F80D5DC3E0C06EF79C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c15a6602-c3a2-468c-abac-873867a9786c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c15a6602-c3a2-468c-abac-873867a9786c.tmp
Size 18KB
SHA256 4235cafe42b8cc7e25bb078810840dc95d84bd96dab7eb9691040bc6e740c5ea
MD5 dfb75e7aee5b677a024e2147c58ea4a1
SHA1 0a9a8e2ff6ca52014815bd25f550c4f6262fca18
SHA512 3221a14bf417784b00038541a1fd37cb05cdc0f927db082c963c432ac3087efaee553d749fb8919b0f25f0910e98c266d819dbf04845e2b44162838b87e1122f
SSDEEP 384:9ZcIhsNSs/6ziyXve+CXOmep3JrE2b7O6R2Feoz2oF:lhzTWvO9p3hE2b7TRJm
TLSH
T1FD828D3268384C765ABBD196F5473A139EFC9067D6CA2B80D4EC7F1D05DBB98230AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 120049a475294ab5ed8b7d4e05ce672374cfa458dd2f7b8809960b02c8607ef0
MD5 3b0718116dfe28965fa7a785cdf71f3d
SHA1 7bd328ab2cdc4b3cf204452c3867504bc0125309
SHA512 ce81f997b900cad3208b52ac3885902d4beda1efd39cfa267f43db8bbfe184e0dd5b618cd47686ceeed54d84aabab0b8482ac1accba6ffc17f3f5ca55fdb9510
TLSH
T1B141F858A6FA1148B3B76E569BF6686D487FB8373F0AD49E10110E4F0A63A41C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

Prajwal_UBC_1_Page_Resume_2026-08-18_v3.pdf.crdownload

Path C:\Users\Admin\Downloads\Prajwal_UBC_1_Page_Resume_2026-08-18_v3.pdf.crdownload
Size 169KB
SHA256 e2ee9068ca714da7a3ad0f1ee8796ea85292a781b32a00caf34a2a61c85e7801
MD5 e38f0a58cef851556cd2b005002de311
SHA1 0b03758550adc3ff897ec45f2ab234e4aca61f77
SHA512 d2262e159c4ab96672775119336510da4240fe1ec89f218f83e96ebec0a4ee93716140138f4ae0b5290aec3e4b1abeef45fc2a61f581647b1a7d3b22699f1812
SSDEEP 3072:dSVk2BTbDXht1FLTB6BHTRv4+gsxjl5QkrSMvKNiwiszupgIk8b:C9TXhZExRg+LQkrY4FJb
TLSH
T1F704F27EF6AA1C4CEAC3C775E132716C863FB21549CCF1E594288E01B2D586927923DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download