hxxp://interact[.]sh

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://interact.sh
Sample260703-k2nxvsbs2j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
840	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275431704099561"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{9E57A1F4-3A29-4E24-9214-F6B9E4B601B0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4436	3956	msedge.exe	86
PID 3956 wrote to memory of 840	3956	msedge.exe	87
PID 3956 wrote to memory of 976	3956	msedge.exe	88
PID 3956 wrote to memory of 1232	3956	msedge.exe	89
PID 3956 wrote to memory of 976	3956	msedge.exe	88
PID 3956 wrote to memory of 976	3956	msedge.exe	88
PID 3956 wrote to memory of 1232	3956	msedge.exe	89
PID 3956 wrote to memory of 3228	3956	msedge.exe	90
PID 3956 wrote to memory of 3212	3956	msedge.exe	91
PID 3956 wrote to memory of 3228	3956	msedge.exe	90
PID 3956 wrote to memory of 3228	3956	msedge.exe	90
PID 3956 wrote to memory of 3212	3956	msedge.exe	91
PID 3956 wrote to memory of 3212	3956	msedge.exe	91
PID 3956 wrote to memory of 624	3956	msedge.exe	92
PID 3956 wrote to memory of 624	3956	msedge.exe	92
PID 3956 wrote to memory of 624	3956	msedge.exe	92
PID 3956 wrote to memory of 1144	3956	msedge.exe	93
PID 3956 wrote to memory of 1144	3956	msedge.exe	93
PID 3956 wrote to memory of 1144	3956	msedge.exe	93
PID 3956 wrote to memory of 4224	3956	msedge.exe	98
PID 3956 wrote to memory of 2620	3956	msedge.exe	99
PID 3956 wrote to memory of 4224	3956	msedge.exe	98
PID 3956 wrote to memory of 2620	3956	msedge.exe	99
PID 3956 wrote to memory of 4332	3956	msedge.exe	104
PID 3956 wrote to memory of 4524	3956	msedge.exe	107
PID 3956 wrote to memory of 4524	3956	msedge.exe	107
PID 3956 wrote to memory of 4524	3956	msedge.exe	107
PID 3956 wrote to memory of 2852	3956	msedge.exe	108
PID 3956 wrote to memory of 2852	3956	msedge.exe	108
PID 3956 wrote to memory of 2852	3956	msedge.exe	108
PID 3956 wrote to memory of 3564	3956	msedge.exe	113
PID 3956 wrote to memory of 3564	3956	msedge.exe	113
PID 3956 wrote to memory of 3564	3956	msedge.exe	113
PID 3956 wrote to memory of 4420	3956	msedge.exe	117
PID 3956 wrote to memory of 3760	3956	msedge.exe	118
PID 3956 wrote to memory of 3744	3956	msedge.exe	119
PID 3956 wrote to memory of 2484	3956	msedge.exe	121
PID 3956 wrote to memory of 2484	3956	msedge.exe	121
PID 3956 wrote to memory of 2484	3956	msedge.exe	121
PID 3956 wrote to memory of 5080	3956	msedge.exe	122
PID 3956 wrote to memory of 5080	3956	msedge.exe	122
PID 3956 wrote to memory of 1476	3956	msedge.exe	123
PID 3956 wrote to memory of 3608	3956	msedge.exe	124
PID 3956 wrote to memory of 3608	3956	msedge.exe	124
PID 3956 wrote to memory of 3608	3956	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://interact.sh
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffbfb32c188,0x7ffbfb32c194,0x7ffbfb32c1a0
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,16484525884132236756,8286572715153984312,524288 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:3
  2⤵
  - System Time Discovery
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,8368799291803947011,748246662561755421,262144 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:2
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,13561919221639352332,17880263732207372757,524288 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,4356014459782573532,5938409861948264666,2097152 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,17306989568088048820,16192063949103157612,2097152 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,3028084348017258813,12641151413219636628,2097152 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,5606388308286999082,3526967052789286061,2097152 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,1036411170755355859,1381536084307682330,524288 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,15786117665782329224,1049749066272586189,524288 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,10404903385763695390,11952441474401345138,524288 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,10404903385763695390,11952441474401345138,524288 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6228,i,1858705589391049498,9616601547047000542,2097152 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6160,i,3728874197720893173,17604229681497816101,2097152 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4228,i,13944959333079013771,6809106244167986842,2097152 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,4688879368397837687,18400613913875538080,524288 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,17286696617693554668,9071395543083892666,524288 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,1537688424154808878,3601425711366072871,524288 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5224,i,8960331135497908978,987638410130165558,2097152 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,15216471657179664726,12181326015170251317,524288 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5336,i,17914224260178089460,13907771326423849703,262144 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6140,i,5195638497836150721,16728911493411927495,2097152 --field-trial-handle=3096,i,2833433690632282580,10880755863171623463,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 501d68df1fbafcc87d41db33d0480588fc9361c46ea78bc9ebdedab2dbe95914
MD5 f20e7f825975e011992441bcdd435640
SHA1 86f3fc35d0fc3f16fb8874261c7c5d6c85f2c424
SHA512 5aaa65f867a53ee4b859ea661fdf4a712625544b90aff60d8ee53021ec19459b28e0fafd951bdf39ae0ed68a58b6af466b2cf22fdaae76e2b799d56be98d72fa
TLSH
T1AF6192781B720756E36A123FE0F0860CBB73C2EEF92B1E3E439068BA650DB940144D07
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590267.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590267.TMP
Size 3KB
SHA256 8a744cb710a5893c2eaa04f1f0aa5d02bf962c4b29fda368495556b5de462f83
MD5 ff306ef055a44b042ab3eff8dc1bca62
SHA1 8e9117aa3ebd415af3733c16057890486b27380e
SHA512 24eea177608d9c8450ae3c04af507dd87aa49065bd28816ea0f40a07b7188e4120e8dc7b5867a251f90d567fa6a8f783ea45f99aa2ac2c207660b6f56187a5e1
TLSH
T12561927C1B720756E366117BE0F0860CBB73C2EEF82B1E3E4390297A650DB940184D07
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1016ab9336aa8404cfe7edf625b121d9d3e1ce2eb8079f5cc0e83cbf395b567f
MD5 6546ab13974c88c545409c7203ece054
SHA1 acfe0663c878df0d617a5e7ef670ca801ed21d97
SHA512 659f7cecead928b01ff75546db6d09a7da34f8f6f7d090f4a8ce274911f5b9bed9fb1117214e67fd605be702b8fbec43c5187b9ecf72b96bbee7c5535ccb0fc7
TLSH
T13721A0F383E5856ECE1156F06A14BE1BCE1D0505432C3C1585E4EF17E3E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 73d37bbdf707656353b0a7aff5e8123a2876ccfa6e90a724250793bf8c5f9753
MD5 d0373914070bc96c10f5a9453197f025
SHA1 97ff44caa9a56628636c0caae7face28207bf590
SHA512 035bead37fded387cba0704355f89583c2e2c5992d210da56db6e70a68e32de3fd963caf3df1d181e2b108ff32df6e05418b0f07d4849074be5bdf067642ade7
SSDEEP 192:sxZjRVyM/jK1Ml8MkB/fMspYvXPIdpbKH/c6+WNtbf/Y9ILx7TIgrJ:sxZjhMB/fMspcweHF1/J9
TLSH
T13E42D8126A34597BCCDBD709FA55BF53D6F4057292900E44AAFCCA1C01E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 252771b8e4855e252c3994cce9b0e3795c2af3a504a713d3c834b7b900967c1a
MD5 bb71afeb4fd3cbe42fa16cd00cab9b3f
SHA1 a7cdcbe472db2e5e6046e6aa2e1dae41b7e11ec6
SHA512 f969f44d4a809e33737c7b7a6900cec797182eb82681abe8f3a4a1ad61aa1d7457131a9810065275c32cb7f26b10935a69200eb6e4fe2fc6b19e0835e3416edb
SSDEEP 192:sxZjRVyM/jK1Ml8UQrkB/fMseYwXPIdpNSH/I6+WNtbf/Y9IaM7TIg5aJ:sxZjTqAB/fMseDwcH51/B8
TLSH
T11052D712AA34597BCCDBD609FA55BF53D6F4547292900E44AAFCCB0C01E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 064b187328ce7dffc87166841f4da496c0c646b85aaea858c4773ad9004bb2ea
MD5 7cd21955cdc81ab02f7bf93dad7442f9
SHA1 669c377fcb868609d2e86006c520066e13de1a86
SHA512 054fd12979e7adb6b262752d0b43b35a6056fd58a743ca8879f45a52b267622279c4b5e738fc3ba17e8a50862741f6a26c1da866e2bed9604665939148161f11
SSDEEP 192:sxZjRVyM/jK1Ml8MkB/fMseYvXPIdpbSH/o6+WNtbf/Y9ILx7TIg54J:sxZjTMB/fMsecweH51/JO
TLSH
T13F52D716AA34597BCCDBD709FA55BB53D6F4057292900E44AAFC8B0C01E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d246aa441beb6dafe1f4f1cd1ea5e23a90329a8d463a52cfeb4af8fe9a2005d6
MD5 85bc6359bc373afd96f386582cb3c1c0
SHA1 74ef6ea7b6098c9ac0382dd88737af76008a0bb2
SHA512 d3592e3aa0a4e451e27c7b8b51ff82494c89ed7641216b47b3e9baf47f1ff1d6f7075378aa444a3c16748c0e60250f8b6ce367dda1c99b5cb19edd78675f7f94
SSDEEP 768:ohcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN/roeg6u:ohcv21wWvu+Z+u1jaeFLeRNsee
TLSH
T1A6D20B2B280CCB7E4F841E9CED2A6F866ED801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599dbd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599dbd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b5793355aa94262a7cef64aebcdb9fa8e17f854fc3487d20d08c94a206f3f048
MD5 5e913ed20d9f31b011cb58d054179905
SHA1 81abe839ddc157d694a63eba0669317f6fe0d45d
SHA512 4432543426346ddf4c1fdbe59d5e559008b8b60dedd54245edb1245c6e3b25e7627a78e24bfc9d92b695d416c5297dc2a80ffff0e5606dc585c054c2c517fb92
SSDEEP 192:0kzONO6v+YLCkcQmiUyHe08h+CGQO9UNR2CH8qjU6:0kzONO6vz+ksR08h+CxO9+R3hU6
TLSH
T16A121A32BD385C6B5ED2A944F48732179EA95277DA853F80D1DC3F1C02EF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 e2f501353c8fae5c12430e1386ec21eb67c273945a48b52dad59faf6d8d5d321
MD5 47cd701c8ce7f58588b51bfefcd55b39
SHA1 c78479f706e3e6cae5a562eae3a0b3d7a4a11ab9
SHA512 f27e5ff7ac16f33afd9fc1ccfd13676089b092ccb4dd3d7dfb9f6e39f02613911c45f632d7ce4d22f9b62182809762f61029e388c36ca2989f5be57455f1379a
SSDEEP 384:OkxiF1tNn/s3n9SyzsN98TUNTUlIl8A5+yziokSW0se+CxO9+RVhOObjI9G6w7Op:OkYF1j+9ZYwgP5+S9k30H5OoRVh29M8
TLSH
T12EA26C336D688D7BAEE28F95F55A36179FF452BBC5856B90E2C86F0C02DB29C1306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9f7a931cec23da7205c015ffc1fee258804a0033a93c406ea663533aa3bb62cf
MD5 a0828b6ce2c188a1e7db4273ce5a0188
SHA1 42ffc7b8dc7286296cad7e13f08bfa11d7f0408b
SHA512 46895ffd78fe08035725194483281f2f2b4a54a80ed1eb3871cbd93b708c4c93134e84ad0d456c3ef954ef2e05eb1a170c1dac3379b9eef3c5304846b5ef5608
SSDEEP 192:JONk6v+YLNQmiUyzeZh+CGQO9UousrLU6:JONk6vz/zZh+CxO9PfU6
TLSH
T16B02F835AD382CBB9EE2AE05F88737175FA4213BE5912F80D9D82B1C01D768C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 865a279236aa7fd95f1376c0c805e99e5cae122bdc048ce9316314db06f51acf
MD5 a1fb7d5841bc576a37a63dcbbbc81319
SHA1 58aed61983b279b6cec0e2c2dc3f0879760ce8e3
SHA512 d5068391fba20ae13fe871ea6efae6774ebc46eb39f44cadd94de624b1b6a7d81094f3c4893826397f34a7ba2c2bac33725e65b5692786d4fb6da65f1bda01dd
SSDEEP 384:EkFtNn/s3n9SfsNjDA5+yziokSW0se+CxO9+RchOObjI9G6w7OdUK:EkFj+9U35+S9k30H5OoRch29M8
TLSH
T17D929D32AD385D775ED29A95F487361B9FF8527B82892F80D0DC7F0C02DB6AC5306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 06434e9f78954cb571d4c87116356294ee3e78dfd77fe263d389d0fc8ada5382
MD5 2f2ddca23fdc87e584372da39c281b6e
SHA1 b9bf78deca826447febe33c4e1ec948286eaacd8
SHA512 0a6d33fddc68c81eab1aceb567059663cb4bf9b14fd3b53ef9f143715b328b79406eac90c335a0b6205edd433c7542bc8f3876bd8c097c1d2e1296ea990c59ce
SSDEEP 384:mkFtNn/s3n9SfsNj8A5+yziokSW0se+CxO9+RchOObjI9G6w7OdUK:mkFj+9U45+S9k30H5OoRch29M8
TLSH
T1D5929D32AC385D775ED29A95F487361B9FF8527B82892F80D1DCBF0D02DB69C5306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11a44499-b60e-456b-bb86-93f855d84e7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\11a44499-b60e-456b-bb86-93f855d84e7b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0a1ce1256501c2db953920920190060772439ad2d90ccf6daf89ccdbbc0b4a00
MD5 c2913e11860baa60e5a8b11e5ca22d71
SHA1 6aecab628152903cfc48d716835038bbcf0f300f
SHA512 116c3e6d11fe38884d490a21d7ef588f13d212899bf1c1da447d77688441746f7505c5113f96777e2a21dd90dfdc46f758df3ce3b21ddfd93c7a86d505705726
TLSH
T14741DC4CB6FA1148B3B76E5AABF7946D487E78372F0A905E10110E4F4A23B40CD61B37
MD5 SHA1 SHA512 TLSH

Submit Download