hxxp://dps-shipyard[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://dps-shipyard.com
Sample261102-py9glswt8l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4680	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{E69D061C-D7E4-452D-B6FB-DB159C126587}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4272	2196	msedge.exe	84
PID 2196 wrote to memory of 4680	2196	msedge.exe	85
PID 2196 wrote to memory of 1348	2196	msedge.exe	86
PID 2196 wrote to memory of 1348	2196	msedge.exe	86
PID 2196 wrote to memory of 1348	2196	msedge.exe	86
PID 2196 wrote to memory of 3896	2196	msedge.exe	87
PID 2196 wrote to memory of 3896	2196	msedge.exe	87
PID 2196 wrote to memory of 2088	2196	msedge.exe	88
PID 2196 wrote to memory of 2088	2196	msedge.exe	88
PID 2196 wrote to memory of 1388	2196	msedge.exe	89
PID 2196 wrote to memory of 2088	2196	msedge.exe	88
PID 2196 wrote to memory of 1388	2196	msedge.exe	89
PID 2196 wrote to memory of 1388	2196	msedge.exe	89
PID 2196 wrote to memory of 2424	2196	msedge.exe	91
PID 2196 wrote to memory of 1120	2196	msedge.exe	92
PID 2196 wrote to memory of 2424	2196	msedge.exe	91
PID 2196 wrote to memory of 2424	2196	msedge.exe	91
PID 2196 wrote to memory of 1120	2196	msedge.exe	92
PID 2196 wrote to memory of 1120	2196	msedge.exe	92
PID 2196 wrote to memory of 2552	2196	msedge.exe	100
PID 2196 wrote to memory of 4516	2196	msedge.exe	101
PID 2196 wrote to memory of 2552	2196	msedge.exe	100
PID 2196 wrote to memory of 4516	2196	msedge.exe	101
PID 2196 wrote to memory of 2600	2196	msedge.exe	104
PID 2196 wrote to memory of 4824	2196	msedge.exe	105
PID 2196 wrote to memory of 4824	2196	msedge.exe	105
PID 2196 wrote to memory of 4824	2196	msedge.exe	105
PID 2196 wrote to memory of 680	2196	msedge.exe	106
PID 2196 wrote to memory of 680	2196	msedge.exe	106
PID 2196 wrote to memory of 680	2196	msedge.exe	106
PID 2196 wrote to memory of 4124	2196	msedge.exe	110
PID 2196 wrote to memory of 4124	2196	msedge.exe	110
PID 2196 wrote to memory of 4124	2196	msedge.exe	110
PID 2196 wrote to memory of 4532	2196	msedge.exe	112
PID 2196 wrote to memory of 3328	2196	msedge.exe	113
PID 2196 wrote to memory of 4852	2196	msedge.exe	114
PID 2196 wrote to memory of 4616	2196	msedge.exe	116
PID 2196 wrote to memory of 4616	2196	msedge.exe	116
PID 2196 wrote to memory of 4616	2196	msedge.exe	116
PID 2196 wrote to memory of 3208	2196	msedge.exe	117
PID 2196 wrote to memory of 3208	2196	msedge.exe	117
PID 2196 wrote to memory of 4556	2196	msedge.exe	118
PID 2196 wrote to memory of 4556	2196	msedge.exe	118
PID 2196 wrote to memory of 4556	2196	msedge.exe	118
PID 2196 wrote to memory of 4204	2196	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://dps-shipyard.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ffef294c188,0x7ffef294c194,0x7ffef294c1a0
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,15148729207025772996,3899843475206372574,524288 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,15618300420327978648,3861485620820755302,262144 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,17083040588107409622,14880542062715773899,524288 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,13659757176230605887,4422078775627579698,2097152 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,10474519042607806733,5941134171663870102,2097152 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,13087193483040573236,12334809931309676042,2097152 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,12519016013563613564,10926360197898897478,2097152 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,14828364169652214459,4157257943186396749,524288 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,8020558163875694761,14679781068267769114,524288 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,2267503137375650446,14600462228363080504,524288 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,2267503137375650446,14600462228363080504,524288 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6204,i,8619797725848300639,5190022295096768127,2097152 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3524,i,13341054232441477753,199277662955815111,2097152 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5844,i,11064128707230000182,6515866636227120937,2097152 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,17534991697421978663,17945147584998414990,524288 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,14447758045160654269,4833418808705327496,524288 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,4725015312565299502,1322180307143902957,524288 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5316,i,12804436709599963849,10037719793767027956,2097152 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1204,i,15552550113812057075,8532159610062675412,524288 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5924,i,8805067877683087728,17312573527429620445,2097152 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2128,i,14984760754381627014,17189958853408436956,262144 --field-trial-handle=2316,i,3420636117842639991,3090365491884725681,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

89fa0d35-01bb-448b-9b85-ef8500073233.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\89fa0d35-01bb-448b-9b85-ef8500073233.tmp
Size 8KB
SHA256 9bb1f53186b90e78e1041867a0dd43c4f4c4240c58ebe4a72a9826e49d46fa46
MD5 79da9dc66f1176cadee55cf3e98f80e4
SHA1 0cead5080293dbba09f8e9d70d48da7d5dd4a22b
SHA512 2615c102370386cd05811325b8369b128acddcc4738151abb612231dc4c1391c52448954c48156811dfc075cc204a986e0523e942125c5d0ec4b818aa7ffdfcc
SSDEEP 192:AONU6wlDxQmiUyx4Zv4X58gZejzorxJgXA7R+2CveGqXU6:AONU6kPNv4X58EC8xJgXw+2l7U6
TLSH
T191121836B468AC2B5EE2A549B08735039FE55227EB897F90D6EC1B1C01EF65C134ED13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9db11cb8-0934-4674-82dc-3575a8813858.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9db11cb8-0934-4674-82dc-3575a8813858.tmp
Size 18KB
SHA256 1aaef4db3ec066bf1637f173f43df77792050e01fa2f9ca30c6603252326969e
MD5 8031b7c2c3d0505dc13c8a09d8110365
SHA1 15b87e0bb13ec5f6d2386e636a48bb8d52523618
SHA512 5a1a4db52dc22f2ebd12506dced13b2ad7016074c35c1700f94b9cb97782be7eac5df5b688910134beaf6c4a744b556dcecabb72aaf9f5340f6f6b0bb817aa55
SSDEEP 384:vQkUSv0sNB5NYJZ03tHX58EC8xJgXw+2c7H7vBEyhIIl8:x0eYJI5aHwlc7H75E6La
TLSH
T13A828D32A868AD3B4AF3A505F14A3903DFB4911BD6D92F90D6ED5B1C00DB29D234FE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e9ac8a9-2aa5-4dce-89ba-b377cac60025.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9e9ac8a9-2aa5-4dce-89ba-b377cac60025.tmp
Size 8KB
SHA256 85fab4695322936c50e470f901edc823411f5696649221201c33274f353269a8
MD5 f3a16080d63ffd0057f78cbc5667cc5d
SHA1 1d339e09d0bbb5c084e49d91adbc848d11868d97
SHA512 7ce1e0d85edc1ebaa976b25f404ee575c44edd5a83d07126150b917869ed70ae0b53dbafb3eb0733d7a2e250fb76976f3c14576d78c1a211082d591ed9a1350f
SSDEEP 192:1ONO6wlDgQmiUyxZZW4X58gZejzorxJlDlnFU6:1ONO6kg+W4X58EC8xJLFU6
TLSH
T178020935F9687C6B9EF3AE09F48627139FE5112BE6552F84CAE80A1D00D765C134AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

5302b68b-1707-4929-ae3e-27d939c0c1ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5302b68b-1707-4929-ae3e-27d939c0c1ff.tmp
Size 9KB
SHA256 7a74ba6cd4094d752d74c3e00a0449bac842c352af2fec4d39fb0913c974e5d4
MD5 eee90da07d6db3d12168f7119851a423
SHA1 e31227caa09b7ff0beea61c85998b680ae6fb601
SHA512 8ace0cff389db063feddb81fd9138b43d7ddf18c26a251f3bd67adf41ed1503950d3267643089c807eb1e00cd0da335c2878b7712151d3c606470b503d07794f
SSDEEP 192:sxZ4RnWF/fss6YIdp/PXHVv6+WNGYrvlMIIgrJ:sxZ4AF/fss6pXHKGU9
TLSH
T14F2296526E28A97B8CC7E21DBB15BF13E6F9503291D41E58EAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8722fe3d-d827-4bea-aadf-2f73f4f59a6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8722fe3d-d827-4bea-aadf-2f73f4f59a6d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 fe3c2a31293f38d563243b3fa41e7aa9c677fb8c3d8e0fafe44f50887a44e878
MD5 fac4e7cfd9f969c32a64b51ead866c0a
SHA1 88150fbaf429d21733b3cc91ebc0bb2f74d688b6
SHA512 ea4436010fcb77b33dd53247af2afa4679058710f490ee1a08771977631e58938fd055255aec7f1a1c78a335e7db770ee02d18da4e1315195a11accfed4e2954
TLSH
T129612E86E48E4463DBB491FD9DE12CCB3938C6F046AB1D5A0398D8795F27F9272B005C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d5d045e0935c8157630aa60fe008f61805300b0019de31807a96c4549dd5cbe9
MD5 c17e26c596e390fa152917ba797b8f83
SHA1 b315a767b57a53a583880935c5cc9182e739fa89
SHA512 3cb0b15349e38c0964c887ede467103948a03af022fd76c61ba583c3fd9f71bf16b49e7098f9ce1fca3bd7b5f5e3567a25da8d391681a8885f4f5c56bba808ae
TLSH
T1A8612E86E48E4463DBB891FD9EE12CCB3938C6F046AB1D5A0798D8795F27F5272B005C
MD5 SHA1 SHA512 TLSH

Submit Download

b9fc0f7f-f69b-4ec6-890b-047e1e1abeec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b9fc0f7f-f69b-4ec6-890b-047e1e1abeec.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

281dcbf9-c449-47d3-8246-ecf9975ec9ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\281dcbf9-c449-47d3-8246-ecf9975ec9ed.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

81a1c709-850c-4a07-af91-2c8e3ab82bd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\81a1c709-850c-4a07-af91-2c8e3ab82bd8.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c82b25b7-3ef8-40f1-8350-6107e3906e07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c82b25b7-3ef8-40f1-8350-6107e3906e07.tmp
Size 949B
SHA256 4fc523100efcab6554826734972f5e61ae27944078ea3ade899c098b4b648b9a
MD5 de39db59a1ba2e783c1023dc03c2a88e
SHA1 40caca8794f757c8d5a30469b546b0c70e564c31
SHA512 1e1d4dd347a43823d4268b9da61200d05074e2f1b127340c0e50a3a25e5ca82852fcc8422aaddf69df9682f6c069cf0eab21ea096349117f0505de5bb376c308
TLSH
T1C8117DF3C3D5856E8D0556F05A24AE2BCE1D0616421C7C15C9D4EF2B93E3475E00159B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 02cc924c6bf8061e30353da388947eeb9ac502b39ff3daa2f1e6992626a26860
MD5 d469c2dcfea78676b495941ba6f5cada
SHA1 5441259b10d03c66707fd0c1b420a36fcfabaebb
SHA512 50f5c00ca37fbc40c2390b90be4eff80b9c1f837e59ba8a9e05a56857b38b169324939b586d660a36d6ae9f082b0544f4d449db9c10a2b27a0c104a8db92e552
SSDEEP 192:sxZ4RnWF/fssdYIdp/PXHVj6+WNGYrvlMIIg5qJ:sxZ4AF/fssdpXHeGUk
TLSH
T1BD22A5526E28A97B8CC7E21DFB55BF13E6F9503291D41E48AAFC861C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cfd1ad7038c2c21a94f0ef3c20646425120a74ae6121b72c8cd2ad53d653b27c
MD5 c1bc12e4234f75dfd6396d92585f4bfb
SHA1 a55c8807cc048dd0a7a871407f96afd2fb44740e
SHA512 828976521accaf45b4e60909b208451b0c3a399c9307c1f20fbbd8e0edd8a03071034f363be27bf9f2706ef4858add3829d6a6fb7d5195d8d287b987b9f654d2
SSDEEP 48:KIDI1Ks04jyL10JF3jXYbLuLISnbIJKIoszyZoI7KpT:KIDCKs0+iS5byKIoK6oAKpT
TLSH
T1B491B14A706B1A40397E295854B5CA5A664237B33129E5AF7FF884A54E3FF100DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0a5d017-23d5-444e-9433-b46fd5a0b5a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0a5d017-23d5-444e-9433-b46fd5a0b5a8.tmp
Size 10KB
SHA256 9d6dc6f03800fc281228a0d79e4dc63e00f1d4b443692acbb33a552aa0b5e899
MD5 c3c185e9af47741459de95cd30fdfc92
SHA1 18a51fda9bfc38b3a2fe65fb50b9663c11b6c35f
SHA512 72381bec7b33ee15c3f526cb7b4e9f945159dd9458e760786f2565e4ed374d6de8073d85673b8116ab3a249a7c01850f6a240c3cf3470c806ae226ba8bf0dc9e
SSDEEP 192:sxZ4RnWF/fssuYIdphPXHVH6+WNGYrDkMIIg5AJ:sxZ4AF/fssupVHqGvO
TLSH
T1B822B7526E28A97B8CC7E61DBB55BF13E6F9503291D11E48AAFC861C05F76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5f79261-200c-4fe0-bcb7-d1e3f2987de3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c5f79261-200c-4fe0-bcb7-d1e3f2987de3.tmp
Size 27KB
SHA256 c94eab8dfca6a329dc80279eb9b6ac9622b73301728aa358c4af9d4c170eb5b8
MD5 d0228e5a219697f4a5b7414038ad45e0
SHA1 93e9f25b1757e3a3685e1acae614a4c426e4526a
SHA512 15b9ef5e4a0be7a0f3dc094ce59c71e27877d995bc4243cb12025780ec8f5145d12c66caa2f75c5d0687c5099b77371a6450236f59ff2447fdb569825e02910f
SSDEEP 768:B+y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2Tb6roRWU:B+y4J/DWvbtBhu1jajiLm0bxkU
TLSH
T185C20B3B684CCB7E4FC00A9DED5E6F973E9802C79A948D4047FA994C02C77EA51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de271a9e-0719-418d-a607-83669ceb6b52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\de271a9e-0719-418d-a607-83669ceb6b52.tmp
Size 10KB
SHA256 2c2f72a3812e89f6cc832f287d708877b01bda2ab4b7afcf17e97105a1e8345f
MD5 65a9e1950fdb108ea6d33fc03bb0aeb2
SHA1 be6d303ae65f716f4ceb615e0850084291d14d27
SHA512 7f2310d0e672a5bca980f13ea9631f6fab786766ba5c1e2f8ccf9c369d6a97ac94dde053edfc5bde15e9cb9639e211912ccdb8941f697877efb78abaf0644e67
SSDEEP 192:sxZ4RnWF/fssuYIdp/PXHVj6+WNGYrkXMIIg5AJ:sxZ4AF/fssupXHeGLO
TLSH
T15722B7526E28A97B8CC7E61DBB55BF03E6F9503251D51E48AAFC861C05F76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5fe76d5f-210d-4d28-a01a-a0402c213d8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5fe76d5f-210d-4d28-a01a-a0402c213d8b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a49a8dcd-6326-48f3-88ef-7ea7dfe21a34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a49a8dcd-6326-48f3-88ef-7ea7dfe21a34.tmp
Size 21KB
SHA256 f15df6aa224df07c40e8ab5ec57a1d75e429bc165ef76040dd6f75f8096ffb98
MD5 185928fa9fd72527968ba3a6aa9a163c
SHA1 790188e8745e708a9b327ff6aa92a29f68f22fc1
SHA512 f28aade8df09b9548d75015eb3156cb938968090b739b9e2e741ca315e3b4ed5a00efd62c98d5e82a396b7d5907e963297ed5d323e5d2a85946450ad68b87866
SSDEEP 384:BiFzQkUSvHzsNT8TUNTUlIlINYJZ03tHX58EC8xJgXw+2L7H7vBEyhIIl8:oFdTKwgMYJI5aHwlL7H75E6La
TLSH
T1FDA26B33A898DD3F5EB2AA44F14A3503DFB59167C5D5AB90E6EC4A1C00DB1DC234BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea96f55d-fd6a-4cde-b5bf-78371a8201c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ea96f55d-fd6a-4cde-b5bf-78371a8201c5.tmp
Size 18KB
SHA256 bed1501e1e18b13c82221bc93d8916dfd06e4ad8f976f062d68412d27ecdbd96
MD5 19aceef65d07a0fec6ef5bf6108ca368
SHA1 46e8480325757dfd0dc4c559322a2f347a49ef1d
SHA512 6e6407850af6de38b7d26c40115c06051423dd0af02613636d85ce99c13bb3167a78f6b2005d8b16621e8237756a16eda5f84c74e7ebfdcc6531f9fadaf2ea3e
SSDEEP 384:9QkUSv0sNBINYJZ03tHX58EC8xJgXw+2c7H7vBEyhIIl8:n0tYJI5aHwlc7H75E6La
TLSH
T1D3828D32A868AD3B0AF3A504F14A3903DFB4911BD6D92F90D6ED5B1C00DB69D234FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a841ab2-11a7-40e5-8ee2-f3dab0ad394e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9a841ab2-11a7-40e5-8ee2-f3dab0ad394e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 135114f5b606fbba255b5cfea4743468d5bb8733affae36b3d179e2544150dc8
MD5 4d8dd221c504977136711cabfac3044d
SHA1 97546a2b4bd4f6a740774f756dad155943e3072d
SHA512 b44e9f9ef33c8ed4b6df284bdb9bdfd7ebfecb24947438eb5358c5e2ccef3a69ebc8e460f6119b029d7ac34d70cac3dd2acff59ae6ef46b25a343d1f32f1fed3
TLSH
T15F41095CABF9114873B76E59ABF6A86D487EB9632F07D45D00110D8E0A67E00DC72B37
MD5 SHA1 SHA512 TLSH

Submit Download