4e10ba83982c485f5cece93596c6814d38ef71b493053e58e28c0bc5337f3b38

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
images/ledger-logo-long-white_5.svg
Size 1KB
Sample260522-pc1btaav5j
SHA256 4e10ba83982c485f5cece93596c6814d38ef71b493053e58e28c0bc5337f3b38
MD5 4ebcf8bb4691701fdb1986584905d3b7
SHA1 40473ce06fdb912cc7024f45e417fed5a61b9cf8
SHA512 16eea70b10eafef812dad06be5ee51b25fdcd22c0338c86ba0cb05df9b078db3dbeda2bf40880aaa6e625c08a76a9079b37f2f229654bc71355a1f661f9251ec
TLSH
T1A241B8D44BB002FDCC58A9FE0B58312C5A6551E5F409459DF7E39E2EAD9845CCC492F2
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1336	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31255074"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1963998267"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239255945245784"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{DE7490F1-7571-4911-A37A-6ED8C36A6E0B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1916	msedge.exe
1916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4348	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 4348	3624	iexplore.exe	79
PID 4348 wrote to memory of 6008	4348	msedge.exe	80
PID 4348 wrote to memory of 1336	4348	msedge.exe	81
PID 4348 wrote to memory of 1436	4348	msedge.exe	82
PID 4348 wrote to memory of 1436	4348	msedge.exe	82
PID 4348 wrote to memory of 1436	4348	msedge.exe	82
PID 4348 wrote to memory of 5984	4348	msedge.exe	83
PID 4348 wrote to memory of 5984	4348	msedge.exe	83
PID 4348 wrote to memory of 3316	4348	msedge.exe	85
PID 4348 wrote to memory of 4800	4348	msedge.exe	86
PID 4348 wrote to memory of 3316	4348	msedge.exe	85
PID 4348 wrote to memory of 3316	4348	msedge.exe	85
PID 4348 wrote to memory of 4800	4348	msedge.exe	86
PID 4348 wrote to memory of 4800	4348	msedge.exe	86
PID 4348 wrote to memory of 4472	4348	msedge.exe	88
PID 4348 wrote to memory of 4048	4348	msedge.exe	89
PID 4348 wrote to memory of 4472	4348	msedge.exe	88
PID 4348 wrote to memory of 4048	4348	msedge.exe	89
PID 4348 wrote to memory of 1696	4348	msedge.exe	90
PID 4348 wrote to memory of 4148	4348	msedge.exe	92
PID 1696 wrote to memory of 4740	1696	msedge.exe	93
PID 4348 wrote to memory of 4180	4348	msedge.exe	96
PID 4348 wrote to memory of 2320	4348	msedge.exe	97
PID 4348 wrote to memory of 1408	4348	msedge.exe	98
PID 4348 wrote to memory of 5224	4348	msedge.exe	99
PID 4348 wrote to memory of 5224	4348	msedge.exe	99
PID 4348 wrote to memory of 1916	4348	msedge.exe	101

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\images\ledger-logo-long-white_5.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/images/ledger-logo-long-white_5.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff91bcac188,0x7ff91bcac194,0x7ff91bcac1a0
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,12551461301407271307,2355995292788034935,524288 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,13264551212420804210,14879324725260979975,262144 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,7668842039768227727,4218336368778575769,524288 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:13
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,1923052943951273650,7296098113529311245,2097152 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,6533489715719785404,16187295602849032504,2097152 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,10840307795953190291,3669920916221477189,524288 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,4756908093939335970,5540289176275573579,524288 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,181364703457070594,4679466730047496746,524288 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1140
      4⤵
      PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,10324786478761539004,9762990750959788786,524288 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,10324786478761539004,9762990750959788786,524288 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,16234046441649981633,8624920703387151905,524288 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
    3⤵
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,2698769626518722164,16142452428767108521,524288 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,15394346018427961607,6180898108942190419,524288 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,18417877600471448090,9575729290824199727,524288 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5508,i,6789727432643768883,1654228957799920367,262144 --field-trial-handle=2372,i,9171692731607895434,776580829147034070,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f8b91ebf1339dfff81c9e7dbbb2e7354a012e6b59c6ebb2516b4c54485908d2b
MD5 0f56bc1b1ed2779bef3ea26fe6ad7050
SHA1 ad67ddba2ac6f98a707ad4cb76f1a66d0f4f5847
SHA512 58771ed0f9d1937f75a4032531917a322b2c2af470949e2743e73db88bac16b40a36ee72eb1ad387606a97bdf2a5f729d63fa99de56f0f99b3f487374577dd5f
TLSH
T18BF0A9AAC931AC3718FD1B1970A9574AE761136B2781945B3F3D460C4FB573B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f899d027ad07eb4613faa46b420895043e49f3f21f54af6fc4959ceff0e4cc6e
MD5 c95e714d821cffba8f9688f9ea7714a9
SHA1 70e4ace7a54a4718e6f2649e58812d9f3255ab9c
SHA512 c70f2676fa361ad9e31643e69da71844966aba0bbfcae586af92961aaa5f79889f62f01d26e726d946bf30f9c215582ed8d3a7e588738a4fb759d42a97efaec1
TLSH
T1DB41AEF7C3E4856DCA1196F0BA187E2BCE1D0914432C3D5AC5E4AF1B93E2471E14165B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c36e33cbfc237fa35dd1dd2e3b27336b7d32fb33f035db2646103a6c0caf1ac9
MD5 626bfa94767e2e79f888c9d9491149ed
SHA1 7215d3148a237ba486a57f426e771cf060636dd7
SHA512 7e47a94bf05df0e7cce192c6ad7c649210935b0cac861b36713c02edd4908c5750ba99bdb5a74279b0a27ddbd5b3f1c2fe08e4bb306c0ccc3f6b405f10a40a86
SSDEEP 192:sxZ3RgyMqZjK1Ml8UQzcE/fessHEzSE0CXUyynDZzodpEVY/W6+WNGY0dYW6iIg4:sxZ3JqYE/fessHEB0Ly8SoY/bG5X5WJ
TLSH
T19562F906AA38597B8CDBD21AFA557F53D7F9156292504E44AAFCCB0C04E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c0dce78c803e75ac4355391cef955c46b4c70c18a132e1d0ff2a878112b5da5e
MD5 6c3032c66a823b32182cd4fae7af71ed
SHA1 448e0b2a18472c1d7ba246057833c6fe957e73a0
SHA512 e94eea964d67e99b701a1a4c4e0d34828c2a2e57899ad7aac29014e189074e7a2755b8f571c412b8d31cb67584979cc26069875e1e2f14e80582359a42d19ed5
SSDEEP 384:sxZ3J0E/fes8dEX60Ly8SoY/bG5j5jeF9:sPiE/feb0m/bG5kv
TLSH
T1B662F806AA38597B8CDBD319FA457F53D7F9152292404E44AAFCCB0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1d2c190df290fb0afefe572e682e709d98e6ba9cc99b121a88760161a4fdb9b8
MD5 7f59602d5d0232fcb5faa3973e7a2c5d
SHA1 20667e32bcabf961d2a16375a995c3152323cf5a
SHA512 63018cfbf018cfaca93111d85caacd42740221c730354dc45bc2cb9aaaace7f4524b489567c2ef63cb8297c83a9d9dcd963d596a8e7a678db7778fce73f9212e
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV383pQLli:ciWKy8Eq2ADEn5dWRm5rQW7u1jaK83pJ
TLSH
T130030B3B6C0CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 eae41998e4adcf95b2747ddce70ce05d0cffb9f9be7144b2e42a594a0988d343
MD5 1eb72a15ddd4dcf6e2bad07c946e8c5e
SHA1 d1f87c24f396b8dfed4ed960ba19bfaa1a74ac23
SHA512 a31496490ae745e81b8038fed1db00ca10b4c175e1a2220a15b0183e51269aab11e1f109082d46dcd058faf2976424ba5c0fcce1babd290eebd33b48f84fab37
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7ODm:AFBHhTofhno2mB21q3Llbfe3sLDdeEpB
TLSH
T1F9B27E56717B12023C3E291CA7929B370E4272A3345CA56F7BB900BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 122f6add97f343427374dc9c54b0014f51ab960758e935d5d54c6c3b7a433acf
MD5 158d67d018a56cffc3e63b7b7ec2fe08
SHA1 a408351ebf09246601a35be8d5cdd69665bfb087
SHA512 d2261da08d07bbb8c2a4a364731dd1afb76bcd66effe71d0d490a9a647d12231172e6e270b0744ac7406732f3c8988938ff1aaec44aadbcc3354730083068b2c
SSDEEP 768:MFSjZbps3gwgijPXcrtatRK9O6Ds0H24Y:rls3vQO6Ds0HBY
TLSH
T1E4F207F198D7C9B7D89E5B47A33E2E429ABCD15375884A84B7C84D0CCC861BFD20B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3bb6d28baa81bd07deac030bf88728771e7139a1b439336bdc58f4921cbc0079
MD5 04cc813e6b46118f4785ddc563650729
SHA1 c9573f9823b6c3fe5c4ab2ffffa8b84867b2375c
SHA512 7ed2a61e6b5776d891fa7943754a9489247d9d7a8267d399dfca4a403243afd3daf793ae41e8b5503a89c1365e09a4a8a5cd5616088dbeba2e0f3a950fd5b22f
SSDEEP 384:n5fiF9CcmyWCs38NP8TUNTUlIxBydvGo8ajkpfb7ofalgAq9uOhkP+lFYS/TsHyF:wFccps3Awg/37Jofatq9HhkoFYS/F
TLSH
T1A9C24A32ECA9C9F7ECE74F99E74A7A02EEE01163859C99D4DAC81D4D00CB19D570BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 09066c744dd3de5fcd502e3969b53efa44238165ea71f763d178deef22538031
MD5 7879c07dbd4ba71adce0b49ea0c1f9cf
SHA1 cf624d224a879a8ccc5f9321ddf22e15f069d067
SHA512 834246c8dc014507b0a9eb26976e1daa47324a3791659c5c0d6a99b5e63381ad29313d003f4da5c451ce473f5417ccd34dd43d5e8af79bdc2e68fb62304f1336
SSDEEP 384:n5riFStNnNnb91s38NX8TUNTUlIRByo20jkpfb7ofalgAYSJX9OopDnND2i1xBhO:UFSjZbfs3gwgmpJofatRX9O6Ds0H24Y
TLSH
T1A5D25B32D869CDA7ACEB5E95B34A7742EEE411A3898C5ED4E9C84E0D00DB2DD170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 75af86f8829b85b159a55aadc9bbab921aeb96169c3e875beb343870c104c4ab
MD5 c6482917cce159eede0c49f0020ff9fd
SHA1 2465505a00a0af9493ed058ca0ba67ed2f3bcbfb
SHA512 f974b8bc3100a4f1075fedeaf1c65bc07d95a3b3c2abc7c38f11f4cffa5f092b20c9fc0ef40c1671d0c3d0628e756acebdaf1c88399022b491bd23b106b34869
SSDEEP 384:n5riF1tNnNnb9j38NX8TUNTUlIR1yY20jkpfb7ofalgAYSJC9OopDnND2i1xBh2n:UF1jZbR3gwgmpJofatRC9O6Ds0H24Y
TLSH
T12DD25B32D869CDA7ACEB5E95B34A7742EEE411A3898C5ED4E9C84E0D00DB2DD170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2acb1e7627eae2bff6aa19e9784aca339b70a4c1649efea80a2fa4d8df36c2c2
MD5 fd479ed8148a07defd0550d4079fad67
SHA1 1e7157b606f34e4f43eca10b65c7542d208b3dbb
SHA512 ff55ce27303f1790596e8bacd4ad0bc34603466a1f5acc678a5bd334300a8859c1f4dc5982a7840fa4036610719d6ecaafa0df99d5ff9e7659fcc5dfa9e52fab
SSDEEP 384:nBiFStNnNnb91s38NX8TUNTUlIRByo20jkpfb7ofalgAYSJX9OopDnND2i1xBh2n:oFSjZbfs3gwgmpJofatRX9O6Ds0H24Y
TLSH
T13FD25B32D869CDA7ACEB5E95B34A7742EEE411A3898C5ED4E9C84E0D00DB2DD170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download