hxxp://ukankingwithea[.]com

Analysis

user interaction
yes
max time kernel
298s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20260911-es
resource tags

arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28/09/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ukankingwithea.com
Sample260928-ymmcdasdpd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3624	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{CC89BF23-1DE6-40FF-8D97-376BD3375FB1}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5568	msedge.exe
5568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4652	4412	msedge.exe	85
PID 4412 wrote to memory of 3624	4412	msedge.exe	86
PID 4412 wrote to memory of 2260	4412	msedge.exe	87
PID 4412 wrote to memory of 2260	4412	msedge.exe	87
PID 4412 wrote to memory of 2260	4412	msedge.exe	87
PID 4412 wrote to memory of 1100	4412	msedge.exe	89
PID 4412 wrote to memory of 1100	4412	msedge.exe	89
PID 4412 wrote to memory of 812	4412	msedge.exe	90
PID 4412 wrote to memory of 812	4412	msedge.exe	90
PID 4412 wrote to memory of 812	4412	msedge.exe	90
PID 4412 wrote to memory of 1956	4412	msedge.exe	91
PID 4412 wrote to memory of 1956	4412	msedge.exe	91
PID 4412 wrote to memory of 1956	4412	msedge.exe	91
PID 4412 wrote to memory of 4032	4412	msedge.exe	92
PID 4412 wrote to memory of 4600	4412	msedge.exe	93
PID 4412 wrote to memory of 4032	4412	msedge.exe	92
PID 4412 wrote to memory of 4032	4412	msedge.exe	92
PID 4412 wrote to memory of 4600	4412	msedge.exe	93
PID 4412 wrote to memory of 4600	4412	msedge.exe	93
PID 4412 wrote to memory of 540	4412	msedge.exe	96
PID 4412 wrote to memory of 540	4412	msedge.exe	96
PID 4412 wrote to memory of 540	4412	msedge.exe	96
PID 4412 wrote to memory of 4876	4412	msedge.exe	103
PID 4412 wrote to memory of 4876	4412	msedge.exe	103
PID 4412 wrote to memory of 4100	4412	msedge.exe	104
PID 4412 wrote to memory of 4100	4412	msedge.exe	104
PID 4412 wrote to memory of 3184	4412	msedge.exe	107
PID 4412 wrote to memory of 5656	4412	msedge.exe	122
PID 4412 wrote to memory of 5664	4412	msedge.exe	123
PID 4412 wrote to memory of 5672	4412	msedge.exe	124
PID 4412 wrote to memory of 5200	4412	msedge.exe	128
PID 4412 wrote to memory of 5200	4412	msedge.exe	128
PID 4412 wrote to memory of 5568	4412	msedge.exe	130
PID 4412 wrote to memory of 5772	4412	msedge.exe	131
PID 4412 wrote to memory of 5760	4412	msedge.exe	132
PID 4412 wrote to memory of 5760	4412	msedge.exe	132
PID 4412 wrote to memory of 5772	4412	msedge.exe	131
PID 4412 wrote to memory of 5796	4412	msedge.exe	133
PID 4412 wrote to memory of 5796	4412	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ukankingwithea.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffea36bc188,0x7ffea36bc194,0x7ffea36bc1a0
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,1004782462310233687,12691693271457683360,524288 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,10317157418189376793,18183271543045536079,262144 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,6612469166131332996,3505391405845965360,524288 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,5747769902077093362,167371684853749862,2097152 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,16898680227974366139,10462298614254201532,2097152 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4024,i,2933712527618232159,13374326076978227768,2097152 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4084,i,8861525769050690187,18304102980642493217,2097152 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:2
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5024,i,6902425404317537011,14774991537656101071,2097152 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,9610543481088420368,18277549517389162844,524288 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,3001517659889494474,2547495376080777960,524288 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,4891718846592777838,17261825783104129534,524288 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,4891718846592777838,17261825783104129534,524288 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4088,i,3353921532857232928,6193887640672935231,524288 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,11515908044799205529,695460314028477549,524288 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,11709103253008252166,1447766039507462150,524288 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,4991363405427638226,16573003347999723144,524288 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5884,i,4539686555056395282,4669151668468968321,262144 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1028,i,10252074620235917067,17792834984281823337,524288 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1500,i,9094300815694812705,16434684038977924534,524288 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,11460359731581277473,2483686858066436894,524288 --field-trial-handle=2280,i,8160194347286502183,8183394984314304347,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:5796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3e9596ca5a32b63e8dda646c6c9451f293a0a274d766c3534a2572498ad0cc2e
MD5 1ae92210d112e191fc5691c7d92f3e7f
SHA1 c9276613906158feb1e0233edc9a17cd34f2f9e8
SHA512 fde9b4cefd404df23fe814b6199fa4f0257067b8df4b8329e245efc6059f7214452ca25982ae888a18001b23a3f2c87c147068562731b3939da1e4e202a726d6
TLSH
T13A6161C09A438087DFA844F2F1D4078737BB747546671D5369B8E4FC5B0A36878749B2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 951B
SHA256 92be049ee0964985ca3ab5209d1a02d5c20d8a9e12e5971eec32accc4f17f053
MD5 970c0cbbe5cf1479fc7c390ca5b42f21
SHA1 7131f11f00e4d6fce4d75a950b3586294898039b
SHA512 940cdf8e3314af40fe2f7f1978281392b1b9057767968ebf004eb5cb2bf689cd1368ca4e962f6bdef416cb76b6813db2c0bb8952a10ec71b7dade75ea5e6d12a
TLSH
T1E51157B3C2F496AD8D5252F0AA286E17DE5E0505535C3C5EC9E8AF1B97E2464D10098F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 dfc41886986fae3d5b0e9e369b8d56de683ddafb5ff7bbd8e9f415471b47049a
MD5 c2b93b25c866d304b6023ac2a15496f1
SHA1 45b39fc3384017fe2a19d4bdcc915262cdd03b98
SHA512 4a797896d6772c9d0d193cadfee36dfeb4f5d5fac889994e7f19a85a10cb76494d06e9c0f89399d33029fa68ed5d9af25aeb34df9f7aab6b565948c7e3efd082
SSDEEP 192:sxZiLWN/fysYYIup+yHW6+WNNty/YRPwlJIgrJ:sxZiqN/fysYQ1Hbq/mg9
TLSH
T19A22C8126E38A57B4CC7D219BA15BF53E6F9403291D51E48EAFC961C09EA6DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0a003272af7bdd96decd82e4920dc0391b26ab77edf31a4e6d0e6cc785402ac7
MD5 f073736383f716bb2b6b8da651eb4086
SHA1 1a3197c0fa820228db6cad5a1f3c3429c9ee5b2b
SHA512 876a78ccc079ee248e5d7306fd7db7db5b6a45198369fe0f850e8a5f4efd683e5e9f1c6bf2aeb715cae488c22f576969d6335e6aefcba1639f713f9afeed821c
SSDEEP 192:sxZiLWN/fyswYIup0yHW6+WNNty/YRPulJIg5mJ:sxZiqN/fyswQrHbq/mSE
TLSH
T1B522C8126E38697B8CC7D219BA55BF53E2F9403291D11E48EAFC9A1C09EB6DD230741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1d3a544e46edeebdda2b994a898ea50ee5ef4aa8414859506fc3dd0589229595
MD5 987430291638f562f742c4bb06dfbcca
SHA1 a16982b0a8690b1e260c79cf05381205bdf8a8e3
SHA512 74a3e0b9d5a2b051649b4b023603556c2505332015375d1b6a659fc9e0bac0308b855c80e8ef970a0e6035db10b5017e6ef8646f2c7331408c9072221f12e428
SSDEEP 192:sxZiLWN/fyskYIup+yHW6+WNNty/YRPwlJIg5EJ:sxZiqN/fyskQ1Hbq/mgG
TLSH
T1CE22D8126E38A57B4CCBD209BA55BF53E2F9403291D51E4CEAFC961C09EA6DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3c38f83c5418e76d4a04ee6345f0f19027f8c82b93f435805af3157b298796ca
MD5 526446e611fd9b1621aee07608d8e746
SHA1 bbe2ac6f4255613043db13259f50c2974e4e9c80
SHA512 95e3a45b1cf7d67e48b25844d5af32a90276edba6836d44c3e0c92d04c16b9af658062a340e3c011e5b563bf12c3f22c5ed30476c13757e8da826584f65679b4
SSDEEP 192:sxZiLWN/fyswYIup+yHW6+WNNty/YRP5lJIg5mJ:sxZiqN/fyswQ1Hbq/m1E
TLSH
T1D822C9126E38A97B8CC7D209BA55BF53E6F9403251D51E48EAFC861C05E76DD230741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 67792f4953f0edd5c886a3657ee1ed292668d58ffc8191fe694a737f99267fd6
MD5 cb7d264f872b9195b4cffc04018a5142
SHA1 f81ce10a22e0a7c81bdcd06d8fd4ee2d947db37e
SHA512 96b8fc4e287801b495cc75940bfaa364631dcc685b0b1540971f97492ee855e9668e28a7c5511e82c578e61b68c02c64e2183af7e9f1824b91ec55465099e7c8
SSDEEP 768:2uK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3lroO+2Z:2uK9uzYWvcQWsu1ja0HL7Q3eO+2Z
TLSH
T170C20A3F640CCB7E4FC01A9DDC5A6F973E9802D7A6588D4047FA984C02C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e1ff3b382883777d0b4bfd23e4fc1ad132c0f556fde6fb5de68be184e0c8546a
MD5 121a646a3b93eec41c7d0d34ee7e503b
SHA1 2c1a962a4fa919f553341f14f631186f63c87e9b
SHA512 30cbf8a42631919c1a1a9c1b21ef381553652e662f514dfb34b1162035faebf704ac19804a6b63e5031cf5ce938d26c5d96ce704985ed7a764997c677a2c8e45
SSDEEP 24:KX5Ct8xIJpmNUtI/Khhq1+SUz3yX5uZeM8IBKShY1qSbIo4PQMuIlKchA1Y:K0mIeeI/KHqwvyFzIBKkYs0RIlKqAa
TLSH
T18891FB5130FE021038BE685985B4975A524271B3321CEA3B7FBC24B68E66E185CFCECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593faf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593faf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fa3daba083a5f1d0e8189fbdee3d3a2ce0a4130c46eca4fb82bfd47237c2fa58
MD5 3305ef6cdb180b7fdaece566f081ac14
SHA1 a35372b462ff367e12b7b9f52e85df58e20fbd0d
SHA512 bb2ab736efe7e622dd1d1f0255d5ebf03b2822779151380d92b4b68528b806f57c80de229d51a874ba32ee647bd8463d1aa687657ad1ce40f65dbac75bfdbf81
SSDEEP 384:k67FiZcIqzsN18TUNTUlIl5wIqfFOjTV7gUOqVZjJijtgOIwZOy0L+ow:JFQigwgeYnlFOojAjXsb6/
TLSH
T127C23AF248E7887AD8AE5747E77D2E034EBCC067F585A650B3985A0CCC961BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2568ab7dbb302caf3962811a44fa10242697a50f4b8a64771d03288b2c3042f0
MD5 00eb0e7551a6f1350d4f9b1e151cdf70
SHA1 2b12f2f3dd951a0e812d272981dbc5df5b9f982b
SHA512 5793965a9c724cbd5379dde4fc1e938c90da4c6716b233508a8311d72883b40d16cfdeab21e7f5860d610d705a4e34b7aef9143ceeaaf12ea7c1c60555ba2968
SSDEEP 192:SONu6ysQmiUyIl3OCTVg6gUOqVZjS0h3Urq6pU6:SONu6bd3OCTV7gUOqVZjJSjU6
TLSH
T1B6122935B878ACB79DA26545F4C736139FA84167DA867F80D1EC1E0C05EF6AC230BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 95ddaddb0880a6084abd4bbf20edbc5d1bfb8054ea0ff0a3a17c79d9d01e837b
MD5 08b119f4624ec9a8ba7238c6eb8aab14
SHA1 ba78abcd2af2d973de41f014c14236526c0497da
SHA512 53dd5946f54cd9c45458e24679a1e7867e894e0ed13fc07d543e59f014a9b8c19df4e57ebf43b26200140adbb40e943aa8e7e20ae941d080dec648a265ea5d53
SSDEEP 384:xZcIhsNrcwIq+FOjTV7gUOqVZjJqjtgOIwZOy0L+ow:Zh7YnlFOojEjXsb6/
TLSH
T192827E329D786CB75CFAA544F48A3A034FB89067D6C5AB90D4FC5F0D05EA5A8130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e758d2b23d594c64b3c197e6d6e233c579856e99115af07c6c14dc4c26e79643
MD5 f6843eab2d1b28f5b4cfebb3c1227abe
SHA1 ae330576fed63a2e654f9a3b4d088b52bcf920d9
SHA512 5f3cdbf96581a3ce8689e4c32ce9cbbe5144766c96d1f88d21d33c0de54889301b52729d195f0a1a921fef5eaab6d271f75396cb6432d33671ed09ab72bd3f6d
SSDEEP 384:YZcIhsNr5wIq+FOjTV7gUOqVZjJqjtgOIwZOy0L+ow:mhiYnlFOojEjXsb6/
TLSH
T106827D325C786CB75CFAA544F48A3A034FB89067D6C9AB5094FC9F0D05EA5A8130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9870f155a725932a689d54184613baf446cceed127da85f26406cc6f3cc1c454
MD5 85189e5f723e643ca95e6e59eb78ee34
SHA1 b386ad174336d23c25e860d287755b38bf64eb6d
SHA512 c4fe3d0a3b9568fee56f8aca77a3ea54b396e40eb494751d550052c1ffd620457d874396638736c71f12017323df94ce057ce97c3639070a63f39da94aab999b
SSDEEP 192:SONu6ygpQmiUy9ltOCTVg6gUOqczPwwU6:SONu6lHetOCTV7gUOqutU6
TLSH
T15902D635BC686CBB8EB26E45F48B27179FA8117BD9912F80D9E81E1C01D766C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

325f3224-45d2-41de-8bca-0e57132edded.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\325f3224-45d2-41de-8bca-0e57132edded.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8ff198b067aa85bc4867a38f180f4eff80815f2ec4c076d6afe8ef14abfe6fc3
MD5 74e85e9444e925f98c062f251dd774e1
SHA1 c80714333d496ae2af5a9b2fea4b9077efa9ada3
SHA512 e17c2d9385f10cab7a9cbfdcebeb1a2c943f17ddbd4fbc5d3396f1af4ee85fc435a066c6ef48a7886fcaa23b0c33622198ab765451f54a91cddc88812b349eb0
TLSH
T1DB411759BAF91148B3B77E1A9BF6A4AE487B7D372F17D49D10110E4E0A62B00C971B33
MD5 SHA1 SHA512 TLSH

Submit Download