hxxps://pixelbattle[.]fun/

Analysis

geolocation tags

cacanadananorth-americatoronto
max time kernel
299s
max time network
301s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/07/2026, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pixelbattle.fun/
Sample260701-16txnsgz21

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4508	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274177934782395"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{4FA85350-D013-4EA1-A825-BB5FDD686027}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 2972	4012	msedge.exe	83
PID 4012 wrote to memory of 4508	4012	msedge.exe	84
PID 4012 wrote to memory of 3768	4012	msedge.exe	85
PID 4012 wrote to memory of 3768	4012	msedge.exe	85
PID 4012 wrote to memory of 3768	4012	msedge.exe	85
PID 4012 wrote to memory of 644	4012	msedge.exe	87
PID 4012 wrote to memory of 644	4012	msedge.exe	87
PID 4012 wrote to memory of 4368	4012	msedge.exe	88
PID 4012 wrote to memory of 3036	4012	msedge.exe	89
PID 4012 wrote to memory of 4368	4012	msedge.exe	88
PID 4012 wrote to memory of 4368	4012	msedge.exe	88
PID 4012 wrote to memory of 3036	4012	msedge.exe	89
PID 4012 wrote to memory of 3036	4012	msedge.exe	89
PID 4012 wrote to memory of 3624	4012	msedge.exe	90
PID 4012 wrote to memory of 3624	4012	msedge.exe	90
PID 4012 wrote to memory of 3624	4012	msedge.exe	90
PID 4012 wrote to memory of 1416	4012	msedge.exe	91
PID 4012 wrote to memory of 1416	4012	msedge.exe	91
PID 4012 wrote to memory of 1416	4012	msedge.exe	91
PID 4012 wrote to memory of 2720	4012	msedge.exe	95
PID 4012 wrote to memory of 2720	4012	msedge.exe	95
PID 4012 wrote to memory of 400	4012	msedge.exe	96
PID 4012 wrote to memory of 400	4012	msedge.exe	96
PID 4012 wrote to memory of 1228	4012	msedge.exe	98
PID 4012 wrote to memory of 2568	4012	msedge.exe	107
PID 4012 wrote to memory of 1160	4012	msedge.exe	108
PID 4012 wrote to memory of 4328	4012	msedge.exe	109
PID 4012 wrote to memory of 2376	4012	msedge.exe	110
PID 4012 wrote to memory of 2376	4012	msedge.exe	110
PID 4012 wrote to memory of 1748	4012	msedge.exe	111
PID 4012 wrote to memory of 4320	4012	msedge.exe	112
PID 4012 wrote to memory of 808	4012	msedge.exe	113
PID 4012 wrote to memory of 4320	4012	msedge.exe	112
PID 4012 wrote to memory of 808	4012	msedge.exe	113
PID 4012 wrote to memory of 1716	4012	msedge.exe	114
PID 4012 wrote to memory of 1716	4012	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pixelbattle.fun/
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffd08f6c188,0x7ffd08f6c194,0x7ffd08f6c1a0
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,9464168714579702547,8411502296207787309,524288 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1788,i,11580714190377257922,8966830917864968889,262144 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,1594452549754371965,5691068356965412882,524288 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,11920672883932141257,3810081956815114737,2097152 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,14501981649009959299,9142318579427791509,2097152 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,7745350696287507199,6240117943980841533,2097152 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,11593693934799351454,3362843729456419863,2097152 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,17963643435292478210,2834725608976969632,524288 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,15469108348632142244,1377005649262977407,524288 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,12691426933020902767,9518477979188400366,524288 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,12691426933020902767,9518477979188400366,524288 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,15192035256145242406,11934647839715935847,524288 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,6699980736578980996,15854519927705427537,524288 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,994820602943089018,1847989681318150231,524288 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,997356022974269810,8831562269383305337,524288 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6392,i,9219772134071048569,5436126073732737928,262144 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3936,i,17229027656385314792,11484039028331674618,524288 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,4703179374610110074,16559163444930794217,524288 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,9503615612203784229,1860212621476634391,524288 --field-trial-handle=2304,i,6978362825776345529,9721417072250170209,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67c3d537374abf4a4065bd49eb5e79e4d5afe358a5731186278c6aee60766d9d
MD5 4e493aa418041fca5fa30fcbfdf660dd
SHA1 ea939d51c02b7420c2eb0e8a20246e28cd7e7c4b
SHA512 25c896cd04f1a8a5daf896cad6530f5a015265fc30399b7facf3a6fc2016b03aaf4a88ce889166d73a86b0b17a17d7512d0edca0d80e9707d3e081708a5000ce
TLSH
T18CD09B20768D5043C59133B398455F45165D596815569141A434514CDAA5044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dd142b5274202e9a75a06f10e947ab55e8465f0312cd82b5c3107e1921942521
MD5 f360f4ef2dc50e93ffdfa7dba014ff12
SHA1 83209c119effcd954c604fbd3b4c3cd701cbc507
SHA512 8dfafbab42402ea605706acc9ec61bcef300c8f50f107433c40e7749c7fdbd966747b413c83a3fcf365e1ca7c256aecd65b1d172900daafa44ee242463d338f8
TLSH
T128718028354F44DCEB9AF27294E10110FB72A1F859535DBB21B0D879B413764B2D3ACC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5706a3b0ca3582037ff58a407d408fa49e4378e83815dada95fadd37c8a367f1
MD5 ece962b72980084df8b18a71733f55f5
SHA1 6779d0d293066788b609da32421465ca9ade66a3
SHA512 20be9dc1b72b5ea92062a146fa819e99c83ea51cb19aba17945c9243dc4178c0e184b4598ac775c966215543f0fc40d874aa13fbaf4b03df952772579bab3e26
TLSH
T12B619AB7C3E4CA6DCC0166F1BA247E1BCD5D0538422C7D1A88D6EF5B67E24B1D201A8B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c639ec6350883c1a9cd4948c55581c8f1710fe4bf5145d30d3cda16504a7ed4b
MD5 c606a510a476ef415ea04184aa9645ff
SHA1 171e59ade5275b0ab04796fd66215ca103683b43
SHA512 68ef8d5c11a62713648d585117ef8a655e11b73c83e36f4e4573425d61b7cb5a0d1859fb0d4b4e9c39d6a2c0b5dc87fdf3bf3720587df1bf120c65f190005dfc
TLSH
T17D619BB7C3E4CA6DCC0166F1BA247E1BCD5D0538422C7D1A88D6EF5B67E2471D201A8B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 587258163d87fcf0bc7473e327c129f1b8c9c8f2f748554cb2659d665cb898f2
MD5 4493c0b6a51a472486b6961e397992f5
SHA1 6ac1e5332db49fd7570cfefa48e74a30235b4c9b
SHA512 29714ba4681b74259aacc115d961be0d4e97b6e3ed96ba06ce621edb07d6cd7be8ac5ff2438e4869bcd006c57e1ae07e6de01ba335829c7c7eb20e25a825563a
SSDEEP 192:sxZ8RRyM/jK1Ml8UQ2k6/fisk7NSjyIdpK8uIHW6+WN79CI/Y4dNm7+kIg5pJ:sxZ8tqd6/fiskwj7KoHbL/uXZ
TLSH
T19352D8166A346A77CCDBE209BA41BF53D6F54472E2900E44A9FCCA1C05E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bde0f1c3085bffc922d7cf352ed18edb335d365f8c645efd164a5c1cad120df7
MD5 9b69eaf8ec9c2d282df96a874aa12ffe
SHA1 817988b86fc58af022c49fd62b289b38d5146768
SHA512 aec64ef4c05c1ee31ceb0321edf15c979b83ff588a65fc2c363f6cebfcb956eae5fe885fd94250d837aa6d84dd338e90ce09c6d1429eb5a8ecd9a5a108654f31
SSDEEP 192:sxZ8RRyM/jK1Ml8Mk6/fisk7nSjyIdp08uIHW6+WN79CI/Y4WOW5+kIgrJ:sxZ8tM6/fiskWj70oHbL/0vX9
TLSH
T16C52E9166A346A77CCDBD209FA45BB53D6F90472E2900D44A9FCCA1C05E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6757ad65474421eaf19b3cdfb7f7dae4c9c41eaa0b1d67ff4ff4f1fcc1a6566d
MD5 6e080784d0c91d3df24662b6a39b1524
SHA1 33a5333db0a92cfb92d5ffb15b6d648844939bf0
SHA512 1d0bb5f2d3f04533c93b973f1c105df823afeed795e2e8c277f8a98f433c1aed0bea97e86fa6ab40bc54f1818100f7ea016a10d8fd48c2de8eb0d36ce8693a60
SSDEEP 768:52EPO/KWvWeI58F1+UoAYDCx9Tuqh0VfUC9xbog/OVKqLlBHu1iroAuGSG:52EPO/KWvWeI5u1jafqLXO15sSG
TLSH
T119D21A2B680CCB7E4F840E9DEC26AF966ED801CB67984D5447FA884C03C77EB511699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f7ea55566c368c58928b079a7db0dbf720ebb62d880b44906260a4fd4c399fce
MD5 d1a23a2996b6c096c1a9c6594faab2a9
SHA1 b3662bc0d9febb5db8c560c409c4775e9e19dd87
SHA512 7e5ccc6912f9263132812125a72db20af365da5fce00fd9fec86635ba1c939c7cb3f36b09df4ba5bb0ff1b14318bd938653ea5ee091c3c1f6ce56434bff52d00
SSDEEP 96:KwPOKQYWqiwKXq5v4dZvtNhW528gBhK4Igvhc3f+BtiHVCV4VdVZVvVtVNVhz:odXwv4dZvtNs529BLIgvO3f+BtiHgCb9
TLSH
T1E99177067077024138BE284D9292CABBCD8171737044EA6F7F9E51961E66E128EFCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5947cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5947cd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 744ddf4668c832d9f9599f2edab13bf0a3e9843607a2f11bf60d0a510e387cf6
MD5 3359e5cafd8729265491280d9bdc8c1b
SHA1 3feab63def2d8087c58da45669f7948c44dc01cf
SHA512 b84a717dde15af9e5dff5e073466cd94fc713af2c9ab7fbdad80ef63ad3096333151f5932598781cc20eba0352ef657c656d97c359a198694e2175cf1a5326e3
SSDEEP 384:zurQXjZxh6VVsNbUkKoHZREVXq6COZ+lK18qHIqmqnLM5obH:zur0h6/yuUOZ0K1boJSMG
TLSH
T1C5927B3669785D375EA6A641F04B32079FB4526BD7843EA0D9ED4F0C01DF7AC230EA22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9c26767bb8b48470fd57b7aeca334c25057067884ec395f11991a503852f8c59
MD5 c1450c22092165a71e5b2e363e7202ee
SHA1 755633b5e37cb21158557aea0feb4b7485ffe060
SHA512 91c6c5cf9f4fc2e74fc13d9b7b65967972959f1eba706ac01dba4fefd9873125278ae751b633bddaf3ce02bc66bb7fc403e0fd8d54e87b910490253036380b14
SSDEEP 384:LiF1urQXjZxh6V2zsNw8TUNTUlIlkLoHZ5EVXq6COZ+l/18qHIqmqnLM5obH:mF1ur0h6E9wgruUOZ0/1boJSMG
TLSH
T1F9C219F254E78936DE9E9743A73E2D034EBCD157F5806960B7984A0CCC9A2BFD30A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 94a496ecf2b19c71fdc670d500884accead14d9f73dd4ac4ab048364a64a5f2c
MD5 1d514b1c67bfeb64730617347017dd29
SHA1 7716b0b69e70c470c2f6ed03125a99ef03fdf063
SHA512 65f862a333893baaccbc7f7a4b794366cf4cbc358c7d32ad67e3ceaf2f8d55b9b5d5756f18d28cecf1daed99c6e48677da332ef3740b6c3b3c6956b5ac7f7d20
SSDEEP 384:wurQXjZxh6VVsNbUkLoHZREVXq6COZ+lK18qHIqmqnLM5obH:wur0h6/ZuUOZ0K1boJSMG
TLSH
T170927B3628785D335EA6A641F04B32039FB4526BD7843EA0D9ED4F0D01DF6AC230EA22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a12d40206498ad694d62f747306f611f7c7af46187fdef9e1b2c3e6541824bdb
MD5 ca7c15ea43481a11653edabc81ff7d07
SHA1 e7e5df3313620eb64717f64e4e6e30a750493c86
SHA512 00938eb9bc178b3d0b78d8c5c26a6125a5765aa29419a05d495067a8a45a309ad0d19809c500f46e4cc22cb9cb9d69b86778c51db364db7688d8db466bfd0b55
SSDEEP 192:8ONp6rvkQmiUy8KDEhD4XqMB/1jAOBP+l8OIClEqYQU6:8ONp6oYE6Xq6COZ+l/1U6
TLSH
T12012E8327968AC375EE3B685F08736135EA45137EB857B90D5EC2B2C05DF2AC130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 19338d7245929cb4395db127295901b692c52121491e78eb00a2c5ac99d2b557
MD5 8053879715d34b9d531a198144af8742
SHA1 0a40978ff62a9da9c822b818cc7b9b47801b8024
SHA512 abc9d39d26a24f8c8ddb1fc521684c86c4080220523c625656920cb548b4676fc1dc9456ad09000d1440291caebd3821d0305eaac7bfd461c9b03fa62eca4cc0
SSDEEP 192:mONj6rvoQmiUycKKDrKhD4XqMB/1jAOBP+yExf4wU6:mONj6cd+6Xq6COZ+DAwU6
TLSH
T14102D835796C6C779EF6AE49F08737135FA4203BEA816F84DAE81A1C01D725C130A937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee979172-0263-4b28-85f5-56d12e45bdf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ee979172-0263-4b28-85f5-56d12e45bdf4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 62c5745306d0d7674780554bbeaa699a7630394ef03878d1a0310a784b3126a8
MD5 ff2b6c23c6f134c877db525fda4e4f65
SHA1 0d1aaab688c18b9a013edbac52b584220e5b1718
SHA512 a7700a54c0455f8470c3ffc76f4901095f8bcf872f271741af7c02bb0a1561aec9940ca147352cc3b550dc1512794b75db953545142d3f715438d2c618cbf3d0
TLSH
T1F741FA5CB6F91158B3777F5A9BF2A96D847EB8771E06D05D00120D4E0A67B00D8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download