hxxps://srsohan99ff[.]github[.]io/USDT-SELL/

Analysis

user interaction
yes
max time kernel
270s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://srsohan99ff.github.io/USDT-SELL/
Sample260724-vay9mathpc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4360	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293852818049344"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{5BD97F36-7323-4948-A5BE-6E94B2AB6512}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4456	2368	msedge.exe	86
PID 2368 wrote to memory of 4360	2368	msedge.exe	87
PID 2368 wrote to memory of 1788	2368	msedge.exe	88
PID 2368 wrote to memory of 1788	2368	msedge.exe	88
PID 2368 wrote to memory of 4172	2368	msedge.exe	89
PID 2368 wrote to memory of 4172	2368	msedge.exe	89
PID 2368 wrote to memory of 4172	2368	msedge.exe	89
PID 2368 wrote to memory of 1860	2368	msedge.exe	90
PID 2368 wrote to memory of 1860	2368	msedge.exe	90
PID 2368 wrote to memory of 1860	2368	msedge.exe	90
PID 2368 wrote to memory of 4024	2368	msedge.exe	91
PID 2368 wrote to memory of 4024	2368	msedge.exe	91
PID 2368 wrote to memory of 4024	2368	msedge.exe	91
PID 2368 wrote to memory of 3640	2368	msedge.exe	93
PID 2368 wrote to memory of 4800	2368	msedge.exe	94
PID 2368 wrote to memory of 3640	2368	msedge.exe	93
PID 2368 wrote to memory of 3640	2368	msedge.exe	93
PID 2368 wrote to memory of 4800	2368	msedge.exe	94
PID 2368 wrote to memory of 4800	2368	msedge.exe	94
PID 2368 wrote to memory of 3100	2368	msedge.exe	98
PID 2368 wrote to memory of 3180	2368	msedge.exe	99
PID 2368 wrote to memory of 3100	2368	msedge.exe	98
PID 2368 wrote to memory of 3180	2368	msedge.exe	99
PID 2368 wrote to memory of 2820	2368	msedge.exe	101
PID 2368 wrote to memory of 836	2368	msedge.exe	112
PID 2368 wrote to memory of 4588	2368	msedge.exe	113
PID 2368 wrote to memory of 3308	2368	msedge.exe	114
PID 2368 wrote to memory of 2684	2368	msedge.exe	116
PID 2368 wrote to memory of 2684	2368	msedge.exe	116
PID 2368 wrote to memory of 1000	2368	msedge.exe	117
PID 2368 wrote to memory of 1000	2368	msedge.exe	117
PID 2368 wrote to memory of 3332	2368	msedge.exe	118
PID 2368 wrote to memory of 4736	2368	msedge.exe	119
PID 2368 wrote to memory of 3080	2368	msedge.exe	120
PID 2368 wrote to memory of 4736	2368	msedge.exe	119
PID 2368 wrote to memory of 3080	2368	msedge.exe	120
PID 2368 wrote to memory of 4160	2368	msedge.exe	121
PID 2368 wrote to memory of 4160	2368	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://srsohan99ff.github.io/USDT-SELL/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdc902c188,0x7ffdc902c194,0x7ffdc902c1a0
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,15674782060773004903,10288245160889704632,524288 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,3348443915600656398,7955747199314960268,524288 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,6367181673318794695,12570384550727823060,262144 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:2
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,12952495397578540610,6076482880714347990,2097152 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,7232462771474006527,10429047270772680858,2097152 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,12011261132308113941,10755926746218813529,2097152 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,12918702395255608702,12271625479480716645,2097152 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,15366288828135181161,9289073335763685275,524288 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,1734125050925316574,5939623623411919463,524288 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,6695903506597758123,7098308566426562449,524288 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,6695903506597758123,7098308566426562449,524288 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,7339138992882012088,10915805867537309242,524288 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,14692558112629951541,2897741198801112811,524288 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,1059541509199556090,14671676528638190621,524288 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,6544539212616262974,1053738145652450757,524288 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,6099820094091067765,1377344807279163238,524288 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6264,i,5375436236906989492,16859870367419423750,262144 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,6681646357511482753,17181545562005783570,524288 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,16221060383992665116,2045040229717845341,524288 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,9588397539597458335,15989576946876828519,524288 --field-trial-handle=2532,i,15148336768332125124,2475223278459444572,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 dcc024da22670f20b78b49060ab498eead76b1fbbb15dd8d8fa117cd444aefc7
MD5 0317d887e4bebe6875ead969c22dc6f9
SHA1 cfe332d7b3f317ad9403068993c42741d0e6b605
SHA512 93784bce1e9c23741f7879784127223776b50fba7ad8131aabeca45b4dc0916dca68eb138ac5933a478bfd576ead2b61dc42720a725164ed1be9ea9a495520c2
TLSH
T108E04F944EC9C2AEA209A8DB516C675CC2913B1E97C8799A174CD4947182544F3AA690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 17dc68328f2d8d52c5b9ab09f9da870758155492b3aa75d5ea3dfe048ff8a8c2
MD5 e907f1a102be5c2d8914b44455913c26
SHA1 30fcf7de06cec7345c9586b22d98425189044046
SHA512 1d13da849e852289caf302c59a5bd26e2baf3243d221dd4d81b6994babadebbed205da776f1749d32733f0b33255598398f491fe58e63b77bd8527391f511340
TLSH
T1D4E086A507CDC2BEF21A6487416DA36CC291771F97C8699B9708D4E87142544E3FAED0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8305232499417d7f504ffa57100dea71872a66a92a78b27289558ba26f96a96a
MD5 83deb20766654ce5be3c89b16780a422
SHA1 b5cc72332b2271f63a9909fe041407c0aa3127e2
SHA512 c43ce8593364f27346d1ee941424a60898a320489c54743a90ec9b2bd6d8586c40922898c61c796007224f29c4e8ed00af5312f126bb8fcce92d1eacf48e1285
TLSH
T1ED51716D03456883E331B631C4E91711B432ABFE08174E5983E09E7FE62F7E5894789C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c1f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c1f3.TMP
Size 2KB
SHA256 fd2b66a8e5e4c93bdd3783f4fd7e6c6984fa6a12568e3b9e89509bb64d9af971
MD5 6cc595cd1477213eb93c1239180903e4
SHA1 7e5d11f8a4a030f0fb828ab1929acea885704192
SHA512 5b47d406a453fdce2fe6028c6723f9bf6cc0953eccc9456e37b13ef8e0c1955e46edd1773c2e3b04a228f572674e57289080b8e2238963dec6eb927038f04a83
TLSH
T17651816E03456883E331B630D8E91305B432ABFE08174E5983E09E3FE62F7E5894789C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 aa0035ae2a0b12bce2e27d32ca20b4723c59d58e6cd2706ef07e884ccd4d8116
MD5 dcc686aefa9219361ebf95cc26b8e099
SHA1 4453954339ee672ba40095437c996d777a3c4148
SHA512 6fe23c71ad8a667911903292ab2040c37d2641c01535d1eab86ea33bc2781e993a186163896783b24b1044f89a46630bcb59eb597019f078592b93724de92b95
TLSH
T1D55189F3D7E8D52D8A2616F1EA58ED27CE9D0560422C3CA9C9D4EE17D7E2470D20069F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0e9097cf116bc1cab43d33519f4f54603e793aa997cb743268f039416c5cba03
MD5 59d459df86bc40c7f082b310c6c66128
SHA1 024803052a9cae1d22873b451fdeee9300e3fc94
SHA512 6dc36f1ac596d5f3e6d34db1385432163684439737aa8ecdf133f75d957dc79d3af35c39f7e706ef4f68f72eeef94d6e61d5d8267ba916262c922b09be8b43e0
SSDEEP 192:sxZVRJk4/fBsFDzFIdp+lVHW6+WNp78/YwrKc3IgrJ:sxZVA4/fBsFDz2GHbS/V9
TLSH
T12322B8566E38A97B8CC7D209BA15BF03D6F6503295D11E58EAFC960C05EABDD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bcdae3901a0d551fb5377bb4fd01b34faa321b194d25fe96fc2ff9187905cb9a
MD5 64b4a4ef7eff5a2e88237a8e676b7bca
SHA1 0a8f32890ae944bcd1689a9dfa467c504c5cc28d
SHA512 002cb511973f17c9cea6176d8b9fa1ca3b72f1069b3ff4d0fcfee8d12a507e9bf5d412b3aa96de00e8fedbd886b9598bf3338c4de03749c2e0f75f23fd989099
SSDEEP 192:sxZVRJk4/fBsRDzFIdp+lVHW6+WNp78/YwrKc3Ig5GJ:sxZVA4/fBsRDz2GHbS/Vs
TLSH
T10822C7576E38A97B8CC7D219BA15BF03D6FA503291D11E58AAFC960C05EABDD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0dd7ac53a4f7cc2354539aa51971598f6ad8d26735b56a0926b19dbd953f3a2f
MD5 d9e7b8cc53dfefabf593437580484de2
SHA1 7cf06d9da9e1a080b8b1a2aa1e4a113c7e26874d
SHA512 1b69f0249c267358016168b6889f409c6744798ff2439d0a16ced2490e5f2358fff2bc093fa64fc712675ddd52deef49da8e2d4a6920b41cc4f69d7f3310c99f
SSDEEP 192:sxZVRJk4/fBsRD+FIdp+lVHW6+WNp7YXYwWwc3Ig5sJ:sxZVA4/fBsRD+2GHbuXMm
TLSH
T1B432C7576E38997B8CC7D209BA15BF03E6FA507291951E58AAFC870C05EABDD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 be2a0c7ffe256a0c11927b921457b269ad378304c62598342189a2d3cf558db4
MD5 022b16a7e024439c8f59e02e8b8741b5
SHA1 18f1b147fdacee404ca58aac4f1a8d7090fffc80
SHA512 b95c551f7971119d472582d90881fe15b1a1bb121c72558ae3dc47ab03317974f9f228f9965ba5eba7a41dbf4a172dfde507281a935ebfdf8384c0e1f7936e19
SSDEEP 768:AImjYDmWvmKyE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBPLlrZ+DzrofF8ah:AImjYDmWvmKyEu1jakPLZQDA9Z
TLSH
T1A5C2F93F244CCF7E4F801A9DDD5A6F973EA802C76A588D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cdb828c90e8748adf3f599d98f0e29fd9b330696e11c389cd4b5322d2c094ab3
MD5 c9441e671c5154b4ba6b7a7da79a7c31
SHA1 9a84b31ea06489295e481596f276866cf05d0615
SHA512 eb778e36abc8be8d4b4cd6b3ebedbfa2ccdd3c260c66996e4f3653ced0d262917575c977f1fc1f0047cca157cc1878daa4e56006d7cacf3921d864d7e5bf64ab
SSDEEP 96:KEG0KXqSqQ4KhqL7gN5DllNmxCgMhNKksMDNgLDqRF2i:Cfnu7gN5DllUxClhnsMD6LDqRF2i
TLSH
T1E091E04630BB82022D3D3B5C9575CB2ACA81B1673055E52B3FA985650E27E218FFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 59cbf446a20edea2e9491d3bb08c7804c56f22ba83f53da791d00448baa8504b
MD5 eb8fb32ad501c29b1e682af82f49fbd7
SHA1 65fd8e38a0f38837ec3ecc32cf3279e5e6eeeddd
SHA512 6622dd3a939ca0037b706eb0ed15c1bb50689e88a47faab6ee1990e2ce3ede11bbfe11e74f40e0ce8b618ed59a0d3f76e524eb728ebf8b59660a3ead17786939
SSDEEP 384:TZcIhsNIpaWyb2f+9OMYD8FZOObjI9G6w7I:LhkmoO76Z29MI
TLSH
T1D4928E326C389D369DA2E515F48739134FF9817BE6D82F8CA5DCBB0D04AA9BC1316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c5a1d7ef3d10629b98f46f0dd4a6863cb04812c46c1c68eb70f0e1f9a63d290b
MD5 1a809427136a67a02f7bd1ebd11d81ee
SHA1 66cd34414fd4856ed9acdd9c58d8ce7c673ef346
SHA512 90e6439cf092bccb8c8ee3eba713d1201288b3b534847aa5884c88de8a9c8bf7403dba6535460be252911578462be6d6597a3ee395cdcda0e495feef0772dee7
SSDEEP 384:FZcI9zsNIeaWyI2f+9OMYDgFZOObjI9G6w7I:9FEmoO7OZ29MI
TLSH
T1F3C217F158E75836D9AE9307B77E2D120EBCC167B6842A88B7D86B0CCC9597FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f38635c2fd21236016ace1aa67a06317a2f141d59843d81867ba6be5fb8e8c71
MD5 0ff18f2a83a1028fa26cdb1b56fbd6e5
SHA1 396ad588d775abe6ff050221e345967aeb2174b8
SHA512 6b22de8356f627605f4c404a27613a97a61fadd38b0d586eab3097c477954644fed4ed6a4d68969c04c659cd044fae9423eac00ad2104bb5ec564256652af596
SSDEEP 192:EOND6hZ0QmiUyVbpc/+jVfO1SYo25wOZnJL0U6:EOND6oipu+9OMY42R0U6
TLSH
T1BF02E93568686C778EE2AE45F48B37235FE5112BE9956F88DAE81B1D00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 435cfe491d9e90d28662821c6bc4b9cc91bdcbb788200f12413c623016195caa
MD5 5d4fd40fceb7d1acab6f603d0fa0f717
SHA1 1cce21929cf1e4e152011c8f72e73c6caa710a7e
SHA512 ea675827dfa99b81df51d655f6173be273795779571f4137d6be8225a56d807b133a8dd37cb048d0645276e1a41ee5d44054c008790d46461165203858b81ab4
SSDEEP 384:ZZcIhsNIeaWyb2f+9OMYD8FZOObjI9G6w7I:xhfmoO76Z29MI
TLSH
T11F928E326C389D369DE2E515F48739134FF9817BE6D82F8CA5DCBB0D04AA9BC1316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 21b12f8c7936445b62671c4dbff7ce2e33e2bb79812b4354d383cd6e75cd96b5
MD5 824af4728aac811d4f3ca4f7438b5162
SHA1 4a6622200c4589c6c577e9e9b6695bbea3c09c72
SHA512 09bba532be7b187e599fb3418cd18f45c49185d9043c85c3ee2cca58c296b3a4eb568fcfc6458406211b1d89750a72ccb66ec4a2abd3d6bb74aaebe7e58632fc
SSDEEP 192:FONB6hZLQmiUyWbic/+jVfO1SYoQIe05cOqlqgU6:FONB6Bjiu+9OMYDb9ZU6
TLSH
T15412F9366868AC374DE2A955F48736135FE5422BEA857FC8D5DC3F1C00DF6AC230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c93446c4-98ac-44b7-909d-6293855eab1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c93446c4-98ac-44b7-909d-6293855eab1a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d36a571e6c4dff0e6279660e955889f3fb538cab0d2757d71ebe12a5e99ef9b7
MD5 9ed5a3a1e4c7df9f35d416090cd511fe
SHA1 c32231e052ab7cf699012b81cf67d6146002785f
SHA512 94bd873b24fc89edbf292b2959040e81bd90bb8968ceefe59178abe2cf9b53f3d05b2c70dcaca021e3af3cb19c9175b63df4c8afa002af51c152877c66617cb7
TLSH
T109414C5CB6EA1148B3B36F5A9BF6A96E487FB9772F16D05D10110E4E0622B40C871733
MD5 SHA1 SHA512 TLSH

Submit Download