hxxps://formule-prime[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 08:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://formule-prime.com
Sample260928-j1wewaygrd

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	29	https://formule-prime.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a421430d7e93d856	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2404	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{3EF02652-DE2A-4F33-A80C-AF2A7FD70E5F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1832	4932	msedge.exe	84
PID 4932 wrote to memory of 2404	4932	msedge.exe	85
PID 4932 wrote to memory of 5096	4932	msedge.exe	86
PID 4932 wrote to memory of 5096	4932	msedge.exe	86
PID 4932 wrote to memory of 5096	4932	msedge.exe	86
PID 4932 wrote to memory of 3832	4932	msedge.exe	87
PID 4932 wrote to memory of 3832	4932	msedge.exe	87
PID 4932 wrote to memory of 1820	4932	msedge.exe	88
PID 4932 wrote to memory of 1820	4932	msedge.exe	88
PID 4932 wrote to memory of 1820	4932	msedge.exe	88
PID 4932 wrote to memory of 628	4932	msedge.exe	89
PID 4932 wrote to memory of 628	4932	msedge.exe	89
PID 4932 wrote to memory of 628	4932	msedge.exe	89
PID 4932 wrote to memory of 892	4932	msedge.exe	91
PID 4932 wrote to memory of 2104	4932	msedge.exe	92
PID 4932 wrote to memory of 892	4932	msedge.exe	91
PID 4932 wrote to memory of 892	4932	msedge.exe	91
PID 4932 wrote to memory of 2104	4932	msedge.exe	92
PID 4932 wrote to memory of 2104	4932	msedge.exe	92
PID 4932 wrote to memory of 1716	4932	msedge.exe	95
PID 4932 wrote to memory of 1716	4932	msedge.exe	95
PID 4932 wrote to memory of 1716	4932	msedge.exe	95
PID 4932 wrote to memory of 652	4932	msedge.exe	97
PID 4932 wrote to memory of 652	4932	msedge.exe	97
PID 4932 wrote to memory of 652	4932	msedge.exe	97
PID 4932 wrote to memory of 3240	4932	msedge.exe	98
PID 4932 wrote to memory of 3240	4932	msedge.exe	98
PID 4932 wrote to memory of 3240	4932	msedge.exe	98
PID 4932 wrote to memory of 2324	4932	msedge.exe	99
PID 4932 wrote to memory of 2356	4932	msedge.exe	100
PID 4932 wrote to memory of 2324	4932	msedge.exe	99
PID 4932 wrote to memory of 2356	4932	msedge.exe	100
PID 4932 wrote to memory of 2432	4932	msedge.exe	102
PID 4932 wrote to memory of 3856	4932	msedge.exe	115
PID 4932 wrote to memory of 3184	4932	msedge.exe	116
PID 4932 wrote to memory of 4536	4932	msedge.exe	117
PID 4932 wrote to memory of 4852	4932	msedge.exe	119
PID 4932 wrote to memory of 4852	4932	msedge.exe	119
PID 4932 wrote to memory of 4852	4932	msedge.exe	119
PID 4932 wrote to memory of 3984	4932	msedge.exe	127
PID 4932 wrote to memory of 3984	4932	msedge.exe	127
PID 4932 wrote to memory of 1092	4932	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://formule-prime.com
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x210,0x23c,0x240,0x214,0x248,0x7ffd07c8c188,0x7ffd07c8c194,0x7ffd07c8c1a0
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,2434674882606669354,2270740146042400070,524288 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,15884643425275993473,12709481319828636815,262144 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,1405624244353369151,8717822713994379847,524288 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,10635804922869390851,7464499138862663049,2097152 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,7745646206907585584,11925518190118399872,2097152 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,14886438077462597973,6658079284731970010,2097152 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,2453748377729217547,13760132094563401913,2097152 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:2
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3428,i,467068686849184695,305764453851088183,2097152 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3356,i,17978790057800136553,10655008539641045423,2097152 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5364,i,11403327163184032691,4319120085220853915,2097152 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,12106309928164200797,3718295802568882931,524288 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,12135266277136620625,10491026124003055565,524288 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,18342601772779052294,3984626736942506175,524288 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,18342601772779052294,3984626736942506175,524288 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,2474493988280325914,5183290609206322696,524288 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,15114128203746533981,3712015145227894466,524288 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,7113500901895555982,5394825413789947692,524288 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2896,i,450993695806676249,2089831649771221003,2097152 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,447228213313939638,10850024308840277339,524288 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5284,i,18159330520084598396,14293556149940245929,262144 --field-trial-handle=2036,i,10742098324806086929,13928195382507037444,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 39efdb3d2e72b8bb918fca502490fdd690e766e4d7035cf2938a887d857e4187
MD5 99b8ab5630678cbe1885840bf5d98df5
SHA1 0518294b6913a5f78cea16603152286ee80989fa
SHA512 79efee46eaed7fb48527e1804fcc575e35aa0c006d5ba66c030104030f9f6113d5f4f5d16046e56d84d94209eee2193b2729813a1d742967d0cb16596d8d95b8
TLSH
T1F9619382A74343ADFB6B613191D928CF3D35554A458B2F2AC5E4D274B8CF744A71C06F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 35743947152013711a5ec67c70643d8f0223e911e56350b73795c40eb52750d0
MD5 c031e4dcf3370ea00adfc253ebffebbd
SHA1 94d96cb264ddd59acc9004ae1a5cfcdf2412d92e
SHA512 311c883b41feb4380ff5154c1dd4552bc3dff0af1237483b84de43c88599f2ac8f8d5074f1ff788067c6350a5b1fdc97bece23a4ad50a2988e6b6855c518a02e
TLSH
T1C461A082A74303ACFBAB603181D928CF3D35614A458B2F2AC5E4E274B8CF744A71C02F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5935bc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5935bc.TMP
Size 3KB
SHA256 d241b1274763e3becafacce4efed69a2554bb654ceb185160eeff62e40bd12ac
MD5 10a41bba5b3e0695dfac905e30325356
SHA1 93c759674c12d13a5d05ce385791667f1627019e
SHA512 383c6549404e4401f25b98d10421873381b2deac6bf5a09bfcf5e60c01869a3318e01e8d9e8cac42de401a33dd910769db913d30f8d5b3c0c29e1ab656256afd
TLSH
T15F619282A74343ADFB6B603181D528CF3D31554A418B2F2AC5E4D234B8CF354AB1806F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a1030322d4da36ef1165e95e35d1933b1548507d156d80dc070552d30e46ab2c
MD5 350fe78a9bb62d96bb81eaecf3e00177
SHA1 126a119bd2f7c17a84c6b83cde150105981777bf
SHA512 56344e1f7c81fea0f058876c0addd551cd80c32dcc7a637c6f33e319824ce509d7721025bf355eb55ba35ed0e290cf3bba6cbce877b56a3b20cd93df91d31a7a
TLSH
T1CD518BB2C7E4839EC91116F09E146E1BDF2D061443683D6A85DAFB4FA7F1171D141A4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c393b702037e5793a309c6f9b20c704db2a3881baa54155ed48f0ae3e9765402
MD5 bf7b020f554d83d5a4c4320711e6dc66
SHA1 d26afdb50c0075b3a5a188096334efdf94690bb4
SHA512 185933a1eaefaba86c26c9785d151239eb1d7c4c1256ded9b9be50a55f5f05bdff8ea3e77c18c2f61a4f0b05d225a55594bfa920bc0bd506d9600370667c85a6
SSDEEP 192:sxZqRfWhb/f6sD1cIdpw9VHW6+WNP5W/YaXxrIgrJ:sxZqohb/f6sD1FiHbs/V9
TLSH
T18F22C756AE68A97B8CC7D21DFA25BF43E6F9103151D41E88E6FC861C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 399fe4135fcf4d89adf0364e2464c168dcbe76903b5c92112dd65ad1579d69e0
MD5 7bb0404fbac012e456ddc233c25eef20
SHA1 99a47caf863bf6220def382cb67bb388077abc88
SHA512 096ac12a4ca742cf0c5f346566275ae7b1a62ba5e917a46b8481182f68231d39bfd88a857144c9595d6a7f3a19f687fcf750d9eac960e524d93235d453f4970e
SSDEEP 192:sxZxRfWhb/f6s0wcIdpi9UHW6+WNPWdZYaMxrIg5bJ:sxZxohb/f6s0wFJHbIZ+f
TLSH
T1D122D856AE38A97B8CC7D21DFA15BF43E6F9503151D41E88EAFC861C04E76DE220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c452aa9ca4d6529d4fee745ac7f6ffb490020eecc218699eae907db84c5b35b0
MD5 d9d607b8568692694bec1d0bd77cdb00
SHA1 b1d37089473dc7f52041aed263a5fbd04e704c2a
SHA512 9925c271662177f72b17d4b5da8410b8b26f60f9b1e2d1a5581ad34c6c0fcf0052d95c9c1d62d871377fa6f75a7906239d29f6f00462e7f3efceaa3cf94ec5a1
SSDEEP 192:sxZxRfWhb/f6s0wcIdpw9UHW6+WNPSRXYaSxrIg5bJ:sxZxohb/f6s0wFDHbsXIf
TLSH
T19A22C756AE38A97B8CC7D21DBA15BF43E6F9503251D51E88A6FC861C04E76DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f9d7131974b8f9181737f594b43633782c98f9f44d71479d199606ded0947262
MD5 b8c6f9784a872fc0210887e8d6997453
SHA1 0570fd8fa59ecbd59d77636912a83ab17205c42e
SHA512 c2a9e525eadf3440ca1c8305d2041bc87fa88a85de4c7fdb74d5e6f06548db81922e3fd58908ce662ce4c2472688a2b5fd9cc66784a542bb94acab019c0e3029
SSDEEP 192:sxZxRfWhb/f6s0tcIdpi9UHW6+WNP3VdYadxrIg5vW1J:sxZxohb/f6s0tFJHbtdX4f
TLSH
T1FB32D856AE38A97B8CC7D20DFA55BF43E6F9503151D41E88EAFC8A1C04E76DD120784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 65e54e034025a38842271b704a496449e616005986d3e34ef1bf37705e101f40
MD5 bca2f172a4addb0e761302d8394a45bc
SHA1 bbcde11249b66990b92c2d4dcde5a13a5e7b211a
SHA512 ea06943cd378229fbba7e36acde4972b30bfa5fe57c86b74cd74301270ab8446045bc12dd2b24af28fcb3f16249b9a200d68473614ac0fb24a635ca9321f9efe
SSDEEP 192:sxZqRfWhb/f6sX1cIdpw9VHW6+WNP5W/YaXxrIg5hJ:sxZqohb/f6sX1FiHbs/VJ
TLSH
T19E22C756AE78A97B8CC7D21DFB25BF43E6F9503191D41E88A6FC861C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a90ebf0b7421a733106f620ac184aedd7d1fd89086b45bbd9f5b00ede71b74ae
MD5 807e285748a4211598a36d3b16c4e35d
SHA1 a4647178d3f19c2043146c2922d4e616ede48f7f
SHA512 c435a7b3e3b7cf5742bcb13f4e7817ff55ce0e9d6b57b2ad7d20cece1aaa7491a0fa81ba7eaaaaf5491a6c73e75798d260f95528b82626727800f29118dfc411
SSDEEP 768:V2yQRbrWvvlRZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3aroTxZ/R:V2yQRbrWvvlRZu1jaXKLf33RTxZ/R
TLSH
T15EC2E93F640CCB7E4FC01E9D9C6A6F976EA802C766588D4447FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 281c0c9f70359ee5dbbc5d8a219e1c1bb558df2152084cdf8137aa95f1f3a326
MD5 1273e6e7f946698a3b367cc06a164548
SHA1 24c1bcf07ce424952dcab6781560826efdddb0dc
SHA512 c4818d400369cfcc457370e63d80b3a0dea6bf15766470f25a620aa9ed5d1bf1c1d130a2a8a101942cc681b520a547305aaa4e181e8f13b8af26b31ce7221a6b
SSDEEP 48:K0b7b+b/bbblbdbdb+bbNbgblISb7b+K9bL1bJb+xbTbuYbIbZbrbfyLNsh9P7/9:KsAAK9aCK+wKvaEQwK1eK2z
TLSH
T10891DD1133BB061038BD255C84B48B5B928132737554FF3BBBA80566CD6BE094DFE9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

907edcd0-86b0-4080-9942-67d31b97d13c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\907edcd0-86b0-4080-9942-67d31b97d13c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 484a6d8b2fc8a59d5a66430ea7199746d67124fc4239e3c02d39c0bdee011ee8
MD5 387be9318d5c47b9298827a0ee0f620d
SHA1 1fde21a42274b42c9880d875ea50b85a9157fab4
SHA512 cc278ae4db9c81fda0f590a38f6b595b0c6d97d482f6e383ec033540418bce81407e0f2eecf6c7921d0e6ea0c294e5a0ffefbee57f5ad8178d2f035cf1199c37
SSDEEP 384:nZcIhsNVf6UVeSp5u8iGls6otgOIwZOy4Lron:PhPQkGlFoXs/HM
TLSH
T192826C366C78AC7A5DF7A550F54776039FB8807797C89B84D8DDA72C01EA5E8030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 90a89d9617210d923220e431ad8b180296ba9b47982e30213ac55971c06e68d0
MD5 fb99de58addb6d5472ac163d394f9168
SHA1 045b0f4c2044e726764cf0999eee70d51456612c
SHA512 0e05f14f17a76335dd5d181502682d19eed22b12a9609c467c74b28638b398a79b52b8914882f0451bd43bfb0e713de32729024986c6df6704bb2f7fa66b2683
SSDEEP 384:FiFiZcIKzsNv8TUNTUlIl+6UVFSp5u8iGlsLotgOIwZOy4Lron:MFQCGwg2QkGl2oXs/HM
TLSH
T1E8C22AF248E7987AD9AE9743A77E3E038EBCC067B6849644B7C8551CCC961BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 278d780be5a6f898767749500bf21ab29b6116c20f8396066f0577b2305aa608
MD5 8f5e0726b23980f36646efbdb5b9a865
SHA1 a007e8013bf64f204f4b84265a847706bc6a03d2
SHA512 7f642ab8156f95fc623b0af11657c128b38ad34993cf679a0292dcc7348f22dec9b462421cacaea25ad64167d2dadcedf6d2badeb7ab06d66aa8a21db819633a
SSDEEP 192:SONs6iDCQmiUy1/Hq5u88PGquhMSqwVmU6:SONs6/UHq5u8iGlCZU6
TLSH
T1ED02E8386C787CBB9DF3AE15B5877B235FA4013BE6941F84D9E8162C01E769C1703926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 afbd5b8c93a031594ecaa6591878028682ab2e55229b0b1a5170f6820aedab76
MD5 aa4d4d4507b0992d85187d28c8038a8f
SHA1 e800c6a331f0ff71035eda25e76c0e83ab6e42a7
SHA512 4084a9d58cce4857f15fc0c61e7bd509a39ef1e6cb8ff055f130d59a6a522b4e43f4ed1c0cd26974b68ec44cac94076bdf9df29a024fa3a14ddec120c30bb36e
SSDEEP 384:0ZcIhsNV+6UVeSp5u8iGls6otgOIwZOy4Lron:yhQQkGlFoXs/HM
TLSH
T106826C366C78AC7A5CE7A550F5477A039FB8807797C89B84D4EDA71C01EA5A8030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f46ea3e75f5673bdfbbf403993b50719d5e2c42014692fc594fd0b31c8be00a8
MD5 34454a9fc6e16816ee7a9967219fdd80
SHA1 51d07ecb5b9ceafbddd9b318f91567fa8d840631
SHA512 158d12d2104495a30d5b22da5930d808058f33710f1e1f100b2d8f21fe3e8239987fa271e60952188dbf88e4b411924b559bf5d023507f7edbb7768bbf275c37
SSDEEP 192:SONI6iDcQmiUyo/Oq5u88PGquh63OuZyqYU6:SONI6NnOq5u8iGlsBoU6
TLSH
T1BB121B356878BC7B6DE3A951F44736139EA44137DBC86F84D9DC262C01EF698170B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 49899d96f2ba88b598c16ad8e691d145ec3d72415c8180b60107cfa99248f8ec
MD5 ec16c992eaedcab5affda696ef93ef93
SHA1 3623e479fd38b631eeb418abbf381eab511ebb84
SHA512 404162ca54cbf87a356c5e17ce161c64780d5a15c47332e8e11fc60590c7f9264a1aacbb59802bebfa7a79cb3dadd4d9921f7c98bad00bd108be0f384152d856
TLSH
T164412958A7FE1158F3B66F5AABF6A86D487ABD732E06D45D00010E4F0A73B40D861B37
MD5 SHA1 SHA512 TLSH

Submit Download