b3e48a78853e326e1708d214d4a9048de22abca09d7318b96987783906de0580

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
page.html
Size 7KB
Sample260625-pec93abw6r
SHA256 b3e48a78853e326e1708d214d4a9048de22abca09d7318b96987783906de0580
MD5 9f3ffb2391f7273dca2b3f3618169b33
SHA1 ec3c97bab6e488a7eaadd8bd7bb1d27e412be751
SHA512 44449826706442cc34443b7f5e8191770a2052c13bb209749cd4367e0597a697d291d0bf6249684c9ae93a0a4118fac94370550b4f5610164da0fa2d1a5fb415
SSDEEP 192:BriS2TsVcOgyExA9vzp9wRp6nU+RvVa2HMpgWz:BrHU4vVa2kz
TLSH
T135F1C60743A382796C0A926C2FB66A143066C407E178F9F47FDE1545EF0D9E0689A7DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1012	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268632585445091"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{44FC5073-F3BC-4A5B-B2D9-5C9022FFC9E4}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 4644	2668	msedge.exe	88
PID 2668 wrote to memory of 2272	2668	msedge.exe	89
PID 2668 wrote to memory of 1012	2668	msedge.exe	90
PID 2668 wrote to memory of 2272	2668	msedge.exe	89
PID 2668 wrote to memory of 2272	2668	msedge.exe	89
PID 2668 wrote to memory of 5184	2668	msedge.exe	91
PID 2668 wrote to memory of 5184	2668	msedge.exe	91
PID 2668 wrote to memory of 4284	2668	msedge.exe	92
PID 2668 wrote to memory of 4284	2668	msedge.exe	92
PID 2668 wrote to memory of 4284	2668	msedge.exe	92
PID 2668 wrote to memory of 4744	2668	msedge.exe	93
PID 2668 wrote to memory of 4744	2668	msedge.exe	93
PID 2668 wrote to memory of 4744	2668	msedge.exe	93
PID 2668 wrote to memory of 3464	2668	msedge.exe	95
PID 2668 wrote to memory of 3464	2668	msedge.exe	95
PID 2668 wrote to memory of 3464	2668	msedge.exe	95
PID 2668 wrote to memory of 1988	2668	msedge.exe	96
PID 2668 wrote to memory of 1988	2668	msedge.exe	96
PID 2668 wrote to memory of 1988	2668	msedge.exe	96
PID 2668 wrote to memory of 4920	2668	msedge.exe	99
PID 2668 wrote to memory of 2932	2668	msedge.exe	98
PID 2668 wrote to memory of 4920	2668	msedge.exe	99
PID 2668 wrote to memory of 2932	2668	msedge.exe	98
PID 2668 wrote to memory of 3864	2668	msedge.exe	101
PID 2668 wrote to memory of 1236	2668	msedge.exe	104
PID 2668 wrote to memory of 1236	2668	msedge.exe	104
PID 2668 wrote to memory of 1236	2668	msedge.exe	104
PID 2668 wrote to memory of 2108	2668	msedge.exe	105
PID 2668 wrote to memory of 4088	2668	msedge.exe	106
PID 2668 wrote to memory of 2108	2668	msedge.exe	105
PID 2668 wrote to memory of 4088	2668	msedge.exe	106
PID 2668 wrote to memory of 4088	2668	msedge.exe	106
PID 2668 wrote to memory of 4528	2668	msedge.exe	107
PID 2668 wrote to memory of 6108	2668	msedge.exe	109
PID 2668 wrote to memory of 1444	2668	msedge.exe	110
PID 2668 wrote to memory of 2876	2668	msedge.exe	111
PID 2668 wrote to memory of 4276	2668	msedge.exe	112
PID 2668 wrote to memory of 4276	2668	msedge.exe	112
PID 2668 wrote to memory of 1216	2668	msedge.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\page.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x234,0x274,0x7ffa70bfc188,0x7ffa70bfc194,0x7ffa70bfc1a0
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,15800030174980883950,2903213637978108344,262144 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,17221029018212312689,657214131909297935,524288 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,3097569166640830877,17018129361416162946,524288 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,9289157760324326971,16328687225350872169,2097152 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,3719525831165243540,1199545256177346349,2097152 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,5000391310761865590,5775496222375086022,2097152 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:9
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,1601977751558515787,18151381807320850239,2097152 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,3040851581635993372,1721411702687043655,524288 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,3709116845400386066,10890133835996150642,524288 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,7884693108221842059,13942894341679425564,524288 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,7884693108221842059,13942894341679425564,524288 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4704,i,9120610832161822813,12114738742886395823,2097152 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,8553992428125603144,7117304197970896271,524288 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4832,i,9473407927029083003,9707631880418812467,2097152 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,6683192356114049378,2968191160324252558,524288 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,14253572536283080567,13724084515468878905,524288 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,12363472980262519458,17488476115459418548,524288 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,7776034505767074001,4376916259273864803,524288 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:14
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,4066814934250798366,6586763979067916642,524288 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5820,i,523339414068061863,6849518847208883427,262144 --field-trial-handle=2532,i,9013456766388879824,6772345990053359601,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff19e848916f9346514f95113e3d80cd569935b36d785719b19d90f9f740fbd6
MD5 5ab41182d14eb22e7143c63d2e18b77b
SHA1 ca8c747e1a5e38b0f0a08b492fcea6d3a75865c2
SHA512 bbecb67f89826ee2bd219f14bbc8ca87fb260f8a22bd2d52b6ccdb72d47a4b58eeb897a42a6e591bd4e75fe870419162172353d5d3ec7f1fb0fbc7b5dc6adcf1
TLSH
T1AED080757B467B11D58F0472D424E271A737455135D296057170C10E55602D1FFCA0B7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f46172781024fe58b7a7d87a406b81679d17de445e9e90110d33f5747ecc226
MD5 08a5ef0e8eb4590a7f0e6f821698071e
SHA1 1b756aceae48cf2649d310d7ab4883595c2e5bde
SHA512 95c72989df00c3caf1230ca41b6dcbc24f8a592c45202f7b16044b8d574fe569d4db8614652b0d1695d3fe1d795b07ea334de5b4fa9dcbb9d27de40a55592586
TLSH
T155D080757B467A11D58F0476D424E271A737455125D296057170C10E55602D1FFC90A7
MD5 SHA1 SHA512 TLSH

Submit Download

00257414-ddfa-40fb-8372-f10132d95dfb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00257414-ddfa-40fb-8372-f10132d95dfb.tmp
Size 14KB
SHA256 4c5bda16115a78d8adf655db6194f81c6c369543174e7fc39b316a5fae4a86af
MD5 0c97f95207bf2685f35900c5694d480a
SHA1 fb197472d1415e71d5531b237b72498a90050e59
SHA512 a082318ffdc4829248b64c54122e4dcbf6ca425857abd2acda6ef4e7cb4320d88a9c08614f33bf130c28ccb3a49a6547f22b7a56bb3766413c3afa4723edc06d
SSDEEP 192:sxRbR1yM/jK1Ml8UQcZo4/flsnZZzMdybmzoA8peE/g6+WNIY4ps4G/IgDaJ:sxRbtqn4/flsnZZIGL/5Ikq
TLSH
T1E662A816A63499778CDBE209F6517F53D6F91573B2901E44AAFCCA0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 fd850503af8fc365a2b4b80c82350ce11390a6a871dbd226300647c5805cebf0
MD5 988cf498241bea2e2998f9495eecf524
SHA1 040f188121e620feef8d4a882e38898dde4c69b1
SHA512 904562ed335f41a4e9bb2673d6f5aa6ca56d8066e1e1306d84372fd0c5664779409479c30e2f8c4a420274408feea5e30e7a41b0f2e9b676b6df45c79f86984d
TLSH
T1E2616F38B1098914EBF4453498C1B896BFF41A6C753B6F213C8DB3747B0730876DA258
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593241.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593241.TMP
Size 3KB
SHA256 35a5a880f441e9df956d570cff997bf3415af27c8d2920e17d3695e1dec10a7c
MD5 2226111bf801bd12bae5e2857a43a95c
SHA1 6f87e4033c2bbc3586eab983b969193320358bbb
SHA512 d467b21dc86c700259b27fce4be0d40604f61a51c42b3a0b828d77aef2d19fd8fab95d8402dd788c7c0d150c83bdedab704339c94a802c0540fb6e87ea822673
TLSH
T101616E38B50A8914EBF4453498C1B89ABFF41A6D753B6F213C8DB3747B0730876EA258
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4abc09fa6f715286155c74cb812ec80963eedb2109437922b2bc06465e21ed31
MD5 75defc8769785e890cfab2950b1ee831
SHA1 380c6e55c7b54d9c603d982cdddc853f802a41ca
SHA512 c1827887bdeb6672e756087bddc563b903ca2a763127ecaa9c5c2479b4e2856e42770dfdab88cfaeb788211c73125c4a3dc77031a867609339f07f4d624a0640
TLSH
T1C141AAF3C3E4867D890146F0BA186E2FCE2D0915836C3D5A89E4AF1B93F2871E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d10065221a5e80cf11b9a35d57e7b66dd56e6025db5b89b997a70394647d7dc8
MD5 f7626a87726a17b1e288f334ff6103f3
SHA1 f459a01f7483faca789c632b7a4507a90abdf72d
SHA512 ebd0ac8eeddd5c8ef22c830fbc241be8ed3252842924aba1e8959c135fdc4f07792110e1120620ce8b5156360557df0c447a4fc8dc23e321cb969f93faa56dc5
SSDEEP 192:sxRbR1yM/jK1Ml8wF4/flsn6ZzMdybmzoA8p4E/g6+WNIY4pj4G/IgDIJ:sxRbtb4/flsn6ZIG9/5IZg
TLSH
T1C552C816A634997B8CDBD309FA517F53D6F91573B2901E44AAFC8A0C04E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ee6f6abd54295b31eee8208c74edea828dd6f09bb6d8f288908f7b9f379a702f
MD5 cc67b2d529763ef6eacc7d03e0b96805
SHA1 db7ed32fd7353cc29d2289f6003453abd6e708b6
SHA512 ce6b137ed20c4dba7088fe4f7026330f0e4fe1e319ff15a42c121a12578fc501f4dd1b462b708a88c2072b3815b6de5a2e4df462a98defa027f679056a6852c1
SSDEEP 192:sxRUR1yM/jK1Ml8wF4/flsA6ZzMdybmzoA8p4E/g6+WNIY4pj4G/IgIJ:sxRUtb4/flsA6ZIG9/5IZs
TLSH
T1D252B8166634997B8CDBD309FA517F53D6F91573B2901E44AAFC8A0C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2e70f63e9bd43096753853ecd72133f48bf2ac9b9a131f7b665792cbbd760f25
MD5 5a9399255d090f9e5a95277dc52120e9
SHA1 158f8f53b50e0f90bd636d1e93512103d21445cd
SHA512 d1420c3e924e67102d9b82a4256435bd991056f655c7d06484e9899d08d4b56f4298d9e3d92bd0e6a8413cd2f0140281e5cdb476bafbcb5a7c3016ef426b56ea
SSDEEP 192:sxRbR1yM/jK1Ml8wo4/flsnZZzMdybmzoA8p4E/g6+WNIY4ps4G/IgDaJ:sxRbtO4/flsnZZIG9/5Ikq
TLSH
T1D162B816A63499778CDBE209FA517F53D6F91573B2901E44AAFCCA0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 363eb8e7fdd900662d8fd76433ee84607c6d22068abacc99df8d5103e267679b
MD5 0d83201a607b6995a6f6ff87b5c4e0c9
SHA1 a83db0bf4739559fdb69eddbce7617c04b241702
SHA512 7e75d3f322c57df1a01b39ebfe2b07a9f1e33ceaebf158f7e87d05040fc3311bac5f9e6c3fd0e1f5e2e2673cff843a25449319f8f8498530073d0723977db062
SSDEEP 768:NmymipWgvHfSv8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1LxgNroRLPL2De:NmymipWgvHfSvu1ja8NgmRLPa6
TLSH
T112C20C3B640CC77E4F845EADEC29AE976DD801CB9B588D5447EA880C03C67FB911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9a49603e96d8633702d7703680232d0f0f0a6184caa8d5fd87c06a30bc6d4707
MD5 fd3a95b4cf7ee106754ee582fa2b9adc
SHA1 15b2a7e546446394456acb67f4f94be64d8d1bc6
SHA512 dba0d3f9e3e69c50b5c29ea8afbf4a2c12c0445b4e52c75cfb1f4a0cdeb14d08ca810b00637e2b33f97f2dbfa83243491d7bfddd3406d37ad190d5e9e336973d
SSDEEP 48:KMiIfKrqofycmVKWUwBuIfKji4LyJ0IzKlKsD:KMiEKrqysukKjiea0AKlKQ
TLSH
T18F910F02B67B630039BE664981B4991F5A4730F73056A92B7FA874F21F66E044FFC9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59cd39.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59cd39.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 5213b1ee49b45138433c5fedc93dd45acd6252e074a359bf2e5552fee0d43075
MD5 6a03c6df4980a241ef7a5ce8da89f519
SHA1 f6cf4ddecbc4dc7fbb95cd3edbbb5eca2f8763bd
SHA512 75f8a8eea28c361bc3d47eb965dba6d1ada729ddf38f50085542a432e828250ee4cbd45281a88158b5f8c1d8d98a6dc094cf637a58e7ef23c21501854081030e
SSDEEP 768:8jaeqD4MlshiLdMm53nVtjfywfIJqfFzA7NpespIRM0UmkTziwjgzSenApXLPnTP:8qcjhIdMq3nTf7fsqfYQsZ0UmY+nKXn
TLSH
T1BA13B07298705EB78DB7E68A6A0376576FB00253C2C43BC89CDA5E0D41C75EC530B96B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 0905dd5fcbb3696d033170abbbfceacfca1b4dae99a02a78fe4066ec08998671
MD5 c5064eed9483e03e0f6ed605a699da11
SHA1 91c24c2b9bd6122dd9cde793e638f468e58ecf95
SHA512 2bb36425a3a1fa668339a7560aa9e78608a8cb9ce855783c03932a7a25e8079284a83df79bfe4966dc273fa8510b13a2a0a0a29f6e669d055913811136209802
SSDEEP 768:RjaeqD4MlshiLdMm53PVKjfywfIJqfFmA7NpespIRM0UmkTziwjgzSekTQ:RqcjhIdMq3Pcf7fsqfVQsZ0UmY+T
TLSH
T1E803BF3298705DB78DB7E68A6A0376576EF00253C2C43B889CDD6E0D45D76EC230B86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f00c8f081e1820db2a02ef9e45ac444a2179a2e808909cf6cfae5e2b4c34503b
MD5 9b37d6d57f63291330d97e5a802d225e
SHA1 fdea4a1fddd2ffd1a532c5c3fdaaa21e776216c3
SHA512 148d0b03efe73a313293b30220b63547b1823722f8ceec69db512b523b3e6e39f4306785ce37ee72f8d9e83d3b51a8333fcfdb953c08f91cae5b84b191d267e0
SSDEEP 768:FF1j+9U3KwgOVKjfywfIJqfFzA7NpespIRM0UmkTziwjgzSewn12bfMaK:M9U3lcf7fsqfgQsZ0UmY+Ky3K
TLSH
T1CB03AF3398608E679DF7DB897A063307AEF00263D2C42A9499DD9E4D41D76EC130BD6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 2ea6ac6577b718839899446ff93a85c092f6c89fe1509606159e8e9236006b1e
MD5 e4695cf1ae77de9144c3d5f40e28397a
SHA1 ea37f99617f19a183e36e9c226d426cf6e141b24
SHA512 e7569a7cb980dde62526c7914a4e9a49e8ff6bb69249eab3df90bbc8879dc014a07e45e394a3037cb05b1133837d611e85a3651f43a8480de671837571aa9a62
SSDEEP 768:gj+933zVKjfywfIJqfFmA7NpespIRM0UmkTziwjgzSewn12bfMaK:f933zcf7fsqfVQsZ0UmY+Ky3K
TLSH
T1DFF2AF3298205E634DF7DB8E7903374BAEE0025392C42B8488DD9F4D45D76EC631BA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 f56ff4db8a11b1f3323afdcf88ffb2543ca6114823f9820ad78bd613d0a64d11
MD5 53724dfde75e073668652438c16e00dd
SHA1 bc180cd05522862ae763bf45f4d7436602818852
SHA512 03d48c74ade7ce06405e25501f883d88e41b6ddaf4f77d829fc7aa5b1769759438f62b2678cfe063a442b5302d5791d69cdf2c32898a59c65194d09313bc46d1
SSDEEP 768:3jaeqD4MlshiLdMmf3TMfywfIJGA7NpespIRM0UmkTziwjgzGSnApXLPQTU:3qcjhIdMo34f7fsPQsZ0UmYKnKXD
TLSH
T13003BF3698605EB78CB7E68A264336576FB00293C2C43BC8CCEE5E0D42975DD630796B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef96eee8-5618-4c77-be78-f42104906bb9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ef96eee8-5618-4c77-be78-f42104906bb9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

setup_DocusignV2.8.msi.crdownload

Path C:\Users\Admin\Downloads\setup_DocusignV2.8.msi.crdownload
Size 8.2MB
SHA256 0752efe34daa9755e42b70755c9f88f9e5aec5973420bd1b3ddb86561206ebd5
MD5 53b445a50603db963d9bb551553cdc6a
SHA1 54775ef40b75ea20796675c3f505f7c576fbe8d6
SHA512 9a807007280a2e76ea4aed5e8ed956bb70e7ceac92628291be0d3adb7a098ef63bd9dd16da6df617e2a4e3b1f59d4eed6338ff73abf71fab10e2179faed5ded3
SSDEEP 196608:OW7h+APyCwV9to5R5hx0jae5u7dBVVr+XL6iCQ/:3ckwdodraaW6dBrmOih
TLSH
T1C9862328B7E40CA9E9B79271C5AB8924EE75BC053720D19F07B0B2191F3B7A074BB355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download