hxxps://copperlodestar[.]info/dashboard/beta-cache[.]js

Analysis

user interaction
yes
max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://copperlodestar.info/dashboard/beta-cache.js
Sample261001-lm7bbstend

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
752	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{2349F707-B316-4335-AA51-4F5924907BAE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 1584	4372	msedge.exe	86
PID 4372 wrote to memory of 752	4372	msedge.exe	87
PID 4372 wrote to memory of 1988	4372	msedge.exe	88
PID 4372 wrote to memory of 1988	4372	msedge.exe	88
PID 4372 wrote to memory of 3676	4372	msedge.exe	89
PID 4372 wrote to memory of 3676	4372	msedge.exe	89
PID 4372 wrote to memory of 3676	4372	msedge.exe	89
PID 4372 wrote to memory of 1480	4372	msedge.exe	91
PID 4372 wrote to memory of 1480	4372	msedge.exe	91
PID 4372 wrote to memory of 1672	4372	msedge.exe	92
PID 4372 wrote to memory of 1480	4372	msedge.exe	91
PID 4372 wrote to memory of 1672	4372	msedge.exe	92
PID 4372 wrote to memory of 1672	4372	msedge.exe	92
PID 4372 wrote to memory of 344	4372	msedge.exe	93
PID 4372 wrote to memory of 344	4372	msedge.exe	93
PID 4372 wrote to memory of 4312	4372	msedge.exe	94
PID 4372 wrote to memory of 344	4372	msedge.exe	93
PID 4372 wrote to memory of 4312	4372	msedge.exe	94
PID 4372 wrote to memory of 4312	4372	msedge.exe	94
PID 4372 wrote to memory of 2728	4372	msedge.exe	96
PID 4372 wrote to memory of 2728	4372	msedge.exe	96
PID 4372 wrote to memory of 2728	4372	msedge.exe	96
PID 4372 wrote to memory of 2556	4372	msedge.exe	99
PID 4372 wrote to memory of 2556	4372	msedge.exe	99
PID 4372 wrote to memory of 2556	4372	msedge.exe	99
PID 4372 wrote to memory of 1136	4372	msedge.exe	100
PID 4372 wrote to memory of 1136	4372	msedge.exe	100
PID 4372 wrote to memory of 2300	4372	msedge.exe	101
PID 4372 wrote to memory of 2300	4372	msedge.exe	101
PID 4372 wrote to memory of 3408	4372	msedge.exe	103
PID 4372 wrote to memory of 2352	4372	msedge.exe	110
PID 4372 wrote to memory of 2352	4372	msedge.exe	110
PID 4372 wrote to memory of 2352	4372	msedge.exe	110
PID 4372 wrote to memory of 2700	4372	msedge.exe	115
PID 4372 wrote to memory of 2644	4372	msedge.exe	116
PID 4372 wrote to memory of 2080	4372	msedge.exe	117
PID 4372 wrote to memory of 2820	4372	msedge.exe	119
PID 4372 wrote to memory of 2820	4372	msedge.exe	119
PID 4372 wrote to memory of 2820	4372	msedge.exe	119
PID 4372 wrote to memory of 1460	4372	msedge.exe	126
PID 4372 wrote to memory of 1460	4372	msedge.exe	126
PID 4372 wrote to memory of 2728	4372	msedge.exe	129
PID 4372 wrote to memory of 2728	4372	msedge.exe	129
PID 4372 wrote to memory of 840	4372	msedge.exe	130
PID 4372 wrote to memory of 840	4372	msedge.exe	130
PID 4372 wrote to memory of 840	4372	msedge.exe	130
PID 4372 wrote to memory of 1284	4372	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://copperlodestar.info/dashboard/beta-cache.js
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb90f7c188,0x7ffb90f7c194,0x7ffb90f7c1a0
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,12811217526010297401,3086581456389348002,524288 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,1246299183671020998,17601619947019456770,524288 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,1232387139398752300,11787313921324854745,262144 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,16344415914382142969,15552391384248219164,2097152 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,17572657086826593138,7358932545895114452,2097152 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,9852954291384989544,4031322248166310640,2097152 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,11700077624995748208,11843015689360658642,2097152 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5052,i,11941950868450496292,2044696102916750315,2097152 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3672,i,10262259086366318018,1346812506765215749,2097152 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,12698508317019860607,2564544770920094759,524288 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,1696192466824901757,9867288951726087761,524288 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,18056300819450282539,8075669068224107282,524288 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,18056300819450282539,8075669068224107282,524288 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6352,i,13146304888732672179,10687738670437009239,2097152 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,4977262581484434639,13887723208363555937,524288 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,5720216296118560603,12125137761434946430,524288 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,14481688491991963913,16845651826427180137,524288 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2928,i,4753995892326510318,15785885356527602756,2097152 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,11038456438197816062,14346181867036605100,524288 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,12491713968173865126,12728839498061325657,524288 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5132,i,3575742693588734474,753593168845682988,2097152 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5932,i,16716303775959685939,415464066319023776,262144 --field-trial-handle=2376,i,3546539668382592775,1893587792225263237,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 223c00baa6a441efa73db70a909dc28de4dc9eba83fe9994eeb3f95f51077f22
MD5 8a023b834252f65135d3c4f573437aa1
SHA1 100e2131d568e6225a032ba7cb19c2526149529b
SHA512 24c08352fb32c47c48b1480fad3be30896af61ef30577bf24ccab848c3c8494b3da51f3a707159378708ea2cac1c7a826cecf7af6da1fabf7341e5a4c3f59163
TLSH
T12851B68BD768C2AAFB68417441F6D3873330EAA1EEDB1F1A25ECC5BD9F0A7549108354
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 ca0c7553f4a9a85bf8a382563e8110b0a3a58f90fdf0004693a15c10ae480ec6
MD5 48eee30c99e4f8b012fb94fe4669a743
SHA1 c6757571d11d03d87bf4f979de4af200abb14433
SHA512 1b4dc85b344ceb573eb3a685005cbfd5690e19e069267cc150e55c5c4df5f70f0991774f86c77cbc8c8da90727a2b5b7d757c500d4e4907f99f956608d29a960
TLSH
T1F011BDF3C3E585AE890156F05A24AE1BCE2C0605821C7C59C5D4FF2783E3475E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d7c87cf8633a6175bb90d1add343ec53f3865c2b6ba6e754772b4942340f489f
MD5 41e5d9b9275aac483a3b3147eb087ceb
SHA1 bd22b95efb9deaca91ec1b2a16f8d088cce6956b
SHA512 ddceede8f2e3064cffee799761ea18f1b29f6fd5fc8648cbf635f878a8a05b9870fbb6252b13e5a527e86ff8c366b0142a25f02d8265327af1b137418be3717b
SSDEEP 192:sxZDsbRmWFr/fVsdhVUMIdpUl6HW6+WNGYapYeMIgrJ:sxZDsbLFr/fVsdhSVXHbGy9
TLSH
T17E22B6126E28A57B8CC7D20DFB65BF53E6F9503291911E48EAFC861C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 481f81d233a4103ff165aed7df3aee5a97b6f13bf6c652ab8ffedf7cfaa437b4
MD5 04a814eefb2500757823391b50adbb20
SHA1 2ff23703a8bcfe91fc2f11ffd6905d53c09a3b21
SHA512 ecb25ab4dde37e488fa573bb3aad632c92000a3c03c2821cd12ff3282065c77153e261999e69fefaa8e583bf647fa4dad381d6728a762f8ba9dae20af3622f83
SSDEEP 192:sxZDsbRmWFr/fVsHhVUMIdpWl6HW6+WNGYapJeMIg5zJ:sxZDsbLFr/fVsHhSV5HbGTv
TLSH
T1FE22C7566E28A97B8CC7D20DFB65BF53E6F9503251901E48A7FC861C05E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3e6bed01d821bcdf0008f90983256084c36fcaa89cc037d088bec0ea2ebefc4e
MD5 d883d647cb2212af7dd852d2c572ad48
SHA1 351263c93cc60ff1d362732259540d2a23a7acad
SHA512 1f8a7ee53e0af59490cb5f9720a4e3bf32fcb172849007cd533f0761eccc40a7402031f811ec46f5ecf2ad27ec9a089e46d4c09bc1b3a97bffe45fc7a3311a3c
SSDEEP 192:sxZDsbRmWFr/fVsHhVUMIdpUl6HW6+WNGYap+eMIg5zJ:sxZDsbLFr/fVsHhSVXHbGQv
TLSH
T11822C7166E28A97B8CC7E20DFB65BF53E6F9503250911E48A7FC861C05E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 8d6a92c7e502be3da472aa83d0f9e1a3a3b016d2ffaf92d839a8d1bdc3f4687a
MD5 44a9b81fcf2251d94e05be39220e3d87
SHA1 8bd5bdf5fa330771588c51fb3c7da9274028037f
SHA512 08c8d9519581a25dc44f8d3c0712b406e51f5369fd12320447804bf1479a36abe824551ccc1b7082d3cc9452a1ecb09fcfa2b06511f01cbb05ccb8726b5e73d3
SSDEEP 192:sxZDsbRmWFr/fVsHhVUMIdpUl6HW6+WNGYapYeMIg5JJ:sxZDsbLFr/fVsHhSVXHbGyZ
TLSH
T17F22B7166E38A97B8CC7D20DFB65BF53E6F9503251D11E48A6FC861C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c453bfb3dbdc2ce725a145ddb96e93fe1e2a6e963366e89f02c0db6852c72330
MD5 08109957a9070c60838bd65a4b9a1d70
SHA1 e8aa11f517bb84602d36d5c5b12a63a19191723b
SHA512 9c188b941c96a1d164dfc8b29ffa14bb979c40caf671f1fffaa294dd27749a6a83ad7625304c7040c56c2b21ba035f3ebfe758d906f757e97a8ea38cebfabb37
SSDEEP 768:GiWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Zro4MfeimRt:GiWPcLKWvKeEeu1jaClLiF7S4MWimRt
TLSH
T1B5C2FB3B640CCB7E5FC01A9DDC5A6FA77E9802C79A548D4047FE944C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b6203725e01721149985077c31baa55b7c2d5084a9c12070087d52afe1576cde
MD5 bf9db8f8b0e98d3bdfa6cc347747cfed
SHA1 096e8ab92fa93f02485982c4444f9c7e7c007df4
SHA512 92c7245611c8192b0b73709ece30d255f78144ddd685bbcd3bbef0de5e6b6e7630240c1769697f4e1fffe3de79bc6311b1993319d9f821cb2be360992767b825
SSDEEP 48:KsuInKTq03yNRIZKa8kOUInKtOc3yVlMxFTrr+F7CD:KsuwKTqO2RyKa8JUAKtOmCs
TLSH
T105A14811336D0245397E391D82A8D66B615231F2346DFA2F7FFC90998EAAE144CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ceff5e8-4a7c-4c85-865b-533fb63fc716.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3ceff5e8-4a7c-4c85-865b-533fb63fc716.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b780c9a90337522546eff516ec767a36651c9fd5365095cd600ad6a97be4b998
MD5 10d5e1e4c59e617c872fcc4ca494bed5
SHA1 cf2254f5872a48333fdeac985507eb986f395733
SHA512 4dce64d6cf9b143b58616b788ebb68f18a051b72964c1756d92ef88c9493bf5fb2ffe0383a7f81a68d414f5e1ef19631fc087f5b079ade850d439adb151a62bb
SSDEEP 384:tZcIhsNWVsr1PgW+zIGmeh+bQeiqVZh6DKhHto9:1h8rp9IVhQ3iqfYGHtS
TLSH
T1A2828C32AC7CAC769EF7E941F4463A135EB8922797C86B8495DC6B0D01EB2581307A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 28cd7522589bff80fbdf3310471b3f9e9caf972020190b8a2fa4cfc0b99a964e
MD5 d961984d08e7ea58a3ca9e8b4c8c643c
SHA1 d34e9784a5298058be0fb19bd8a231b391196fc4
SHA512 abb9f9a5f9e9eaadfac65aa6815db67145c56bb1676da3ecb2247cda6697fefc36edc4a38a4c42592ddc6d20f4a4f6de7baac8778df652b53570563d7d16497b
SSDEEP 384:ZiFiZcIJzsNW8TUNTUlIlisr1PgW+zIGmeh+bQjHiqVZh6DKhHto9:wFQp3wg3rp9IVhQKHiqfYGHtS
TLSH
T1C5A27D339CACE87BAEF79E41F94A3A138EB45167C6C9AA94D2C85B0D01DB19C1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 49f893ef8b3f610a2375ef380803dc7e0ac7f7417c71da5363f411a72f48db92
MD5 8b8296f2eef43781e9946ce734971dfb
SHA1 0841fcf8112a6b2517039d4eb19570dfd6d72d58
SHA512 7e470fb5d965643e7da4afaf7274f60c642ed3b8becf0c7ac6dacd23e1af3195db76318d848aa3b467343d7d48737ae3757c4c0a05713dff9d5f3f7f2f7caf1a
SSDEEP 192:aONv6IEkuQmiUyLPT6uIGmeh+bQ727HNqDU6:aONv6Dkq46uIGmeh+bQIHqU6
TLSH
T1BE120936A878BC779EE3A940F4873A235EA55227DB847B94D5DC1A1C01EF25C130A917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 66df97cc74b1d80a164d6e55c09fa175388641eb763ac9a5e5c9cc39ddb9461c
MD5 24550a4e417c100a0b7b7c9523480de5
SHA1 0c8fbfa00b750ebdc69719fd225315d6cc9a8497
SHA512 4b1ec9aa3911ff967e8603323a8d49cbd6a2eab9b90738cd319bf719ff8d95d1c546f37116987926d18a55188b9ce81fa729075da5b9a99fb5b63ceafef372c5
SSDEEP 384:SZcIhsNWisr1PgW+zIGmeh+bQeiqVZh6DKhHto9:ghfrp9IVhQ3iqfYGHtS
TLSH
T194828C32AC7CAC369EF7E941F5463A135EB8912797C86B8491DC6B0D01EB25C1307A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8761dc52ced5b39641943ec940c62b5b65758b31f9d94c5e6d3ce5dc1f42f9f7
MD5 8c813a571d5cdc2f389334fe0577d843
SHA1 ba8f48806787b2371ddb7579cd98f7660f1103b4
SHA512 1853c10729e6c700fae5ffad0d5fd26779d4598dbdafc363ac19fcde887f3a8b2d2046eb3c68ed0b8c85b7477a4786b7abf97c6ecd7e36a6f7683a21376c0d1c
SSDEEP 96:3qONkMQsjpfe/tyng7X5ih/cIPURHl8h4otop5zYDPNBnP9ZvEI0IG2jb90ymtID:aONg6IE7QmiUy6PTPuIGmeh+IC7sbAU6
TLSH
T1F602F935AC78BCBB9EF3AE05F4877A239EA5212BA5952F84D9D81F1D00D724C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1e64d9ab548cee19ff954add38c6d85b0d9c25da65a1f997db8f39c6ccb28b37
MD5 f74d3c3ccbe30e281e7f7b8464d9b30a
SHA1 b23886f9a285805bce71f6694353545b90bf5208
SHA512 d23c033dde01647c38cfc96fa8f7fbdc25e9123cfa4418647ccc42cca7eaad3615e9e72fbb6864c2c4aef8758e0524af050a973903437f72b8dffa2ebb3e8cf8
TLSH
T146410458B6EA1148B3B76F5AABF6986D487FBC332E0AD45D10110E5F4A62B40CD71733
MD5 SHA1 SHA512 TLSH

Submit Download