43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2

Analysis

max time kernel
299s
max time network
261s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.55/editor/index.html
Size 164KB
Sample260724-wh7fmsverd
SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
MD5 b33eb96a570d0cdf6ded11ff199d0de3
SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
TLSH
T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com
55	raw.githubusercontent.com
59	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2200	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293894379337073"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{B28CB291-36D1-4DC3-AB66-7AF8F43C9AB6}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 5084	4840	msedge.exe	84
PID 4840 wrote to memory of 4188	4840	msedge.exe	86
PID 4840 wrote to memory of 2200	4840	msedge.exe	87
PID 4840 wrote to memory of 4188	4840	msedge.exe	86
PID 4840 wrote to memory of 4736	4840	msedge.exe	88
PID 4840 wrote to memory of 4188	4840	msedge.exe	86
PID 4840 wrote to memory of 4736	4840	msedge.exe	88
PID 4840 wrote to memory of 2216	4840	msedge.exe	89
PID 4840 wrote to memory of 5060	4840	msedge.exe	90
PID 4840 wrote to memory of 2216	4840	msedge.exe	89
PID 4840 wrote to memory of 2216	4840	msedge.exe	89
PID 4840 wrote to memory of 5060	4840	msedge.exe	90
PID 4840 wrote to memory of 5060	4840	msedge.exe	90
PID 4840 wrote to memory of 4532	4840	msedge.exe	91
PID 4840 wrote to memory of 4532	4840	msedge.exe	91
PID 4840 wrote to memory of 4532	4840	msedge.exe	91
PID 4840 wrote to memory of 1472	4840	msedge.exe	92
PID 4840 wrote to memory of 1472	4840	msedge.exe	92
PID 4840 wrote to memory of 1472	4840	msedge.exe	92
PID 4840 wrote to memory of 2044	4840	msedge.exe	96
PID 4840 wrote to memory of 3344	4840	msedge.exe	97
PID 4840 wrote to memory of 2044	4840	msedge.exe	96
PID 4840 wrote to memory of 3344	4840	msedge.exe	97
PID 4840 wrote to memory of 560	4840	msedge.exe	99
PID 4840 wrote to memory of 3708	4840	msedge.exe	116
PID 4840 wrote to memory of 1740	4840	msedge.exe	117
PID 4840 wrote to memory of 3896	4840	msedge.exe	118
PID 4840 wrote to memory of 2560	4840	msedge.exe	124
PID 4840 wrote to memory of 2560	4840	msedge.exe	124
PID 4840 wrote to memory of 4024	4840	msedge.exe	128
PID 4840 wrote to memory of 364	4840	msedge.exe	133
PID 4840 wrote to memory of 176	4840	msedge.exe	132
PID 4840 wrote to memory of 364	4840	msedge.exe	133
PID 4840 wrote to memory of 176	4840	msedge.exe	132
PID 4840 wrote to memory of 1884	4840	msedge.exe	134
PID 4840 wrote to memory of 1884	4840	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\editor\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a4,0x7ffdf809c188,0x7ffdf809c194,0x7ffdf809c1a0
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,5002974782086649877,17417733340623834810,262144 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,15446006245976171786,9624909980945474461,524288 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,14392392410785376596,10482079868953796457,524288 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,6834010754636243086,13848130338699673146,2097152 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,16137631567912071392,4417447759506691259,2097152 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,4000065851653366564,14363057075918647490,2097152 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,6175463104260659278,4343582435076838109,2097152 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,12655504982540222466,16488933083753377367,524288 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,3291872389784815241,8731768930697060819,524288 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,1833487133413869229,11004541198854114171,524288 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,1833487133413869229,11004541198854114171,524288 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,7128684719938664803,5395276671725769715,524288 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,8032908216487790245,15799085328073510652,524288 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,4594379804276143787,17613339736516947582,524288 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,17836172117684348780,307788580792525857,524288 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6168,i,5264354434507138876,2964966604285140206,262144 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,14082740410474353459,7554138196594640773,524288 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,12252372305146024653,42220924877631900,524288 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,11081433780685285165,16222607257179846621,524288 --field-trial-handle=3108,i,4165874703099200362,14679861853711729807,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a8e21c8049c40826ea9bbd5ad23c3b16e5a0354349c00224428fe07cd3e32df3
MD5 b16d6bf9121d7e7230891bac3ef0cca8
SHA1 91b41a46d49d3e1239ac70cf9f7020f51a806aae
SHA512 5b06ad0c2276a3d17e5f66c401c72da95d36bde6024636ac4c7ad688357416de70467d46357223047c807677bd2e6873311f4fb82bd0baf1d737d32c561159fd
TLSH
T1175150B854826523E7251031A1DA2F7E3876BFD9FE5BCD7740908D32450F7D18369478
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fd66.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fd66.TMP
Size 2KB
SHA256 70ca32b3d69c128fa9c6d6a5bf350cf81ce329614a8282dac183681b481e73aa
MD5 8b65dc851705d333b90e54f325d78484
SHA1 1fb6284fe965ed96ed6840e78e49225a0aa87ea7
SHA512 570fe99c50abc2fe95a4e5c7ade38b21b6c4746dd0643b1713697734cd01d5db33a5c928b8873dd6849c3edb63ac31ef75ab4aab366527014cdf9f1239808043
TLSH
T1A5516FB854826523E7251031A1DA2F7E3876BFDAFE4BCE7740908D36450FBE183A9478
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 599B
SHA256 9c1b9299b952deaf452196a2e547a7f9f634d5eae53289fb6cdb27d620b91526
MD5 75e254f72f7855728406176a5a21b21f
SHA1 5186988d1dbbdc4c6675773e618f4cd12cff49e6
SHA512 86b7cccbe9cfe1e7e80263ab8195089518875cf0758bb67cd889261203aaf029dd34c16bae046dc41c57fa3e0282ae0a508790945834f14c58b3f0428ef8d33a
TLSH
T1F5F042F783E0557E871152F09A146E5BCE6D0413831C7C65C9E4AE1B93F2575D10199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2100ed478d64b683acf40ca52aa396c788f96824b3e92233cd12bb3e1130d672
MD5 ddef8c05cf8d0d19c7aa3656913dbd88
SHA1 564fb194e61c663fecea2c890222d876131f8959
SHA512 882f08944707010934df0a73fd419f524f04846f230d3464d9d8f2ec4136871538cc9b7336edb19dedfa53f366ea4a092a3a877451b985249c42913d5887acea
SSDEEP 192:sxZ8/yM/jK1Ml8MkT/frsSLJRIdpdpHW6+WNGY9IKaofEIgrJ:sxZ87MT/frsSLojHbGJ9
TLSH
T15242E7166A385977CCCBD209FA55BF53D6F50572E2940E44A9FCCA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 23a09d8dba7402188116fae8dab7173adc04fed090893b8f7128bfecd73763d7
MD5 b8fcee105b33d734552b0831f0307361
SHA1 eb7bb85744cf550de1eebc8c735c9aaa65915228
SHA512 18058a4e3d667fb84f53accd8218bce61689ec0a6c096dd4b673d7bc44635e870ba2e86c6522c4dd1a0170e0ad630f47cdab698d5b982355c878a17fae4117a5
SSDEEP 192:sxZ8/yM/jK1Ml8UQ4kT/frsT+JRIdpHpHW6+WNGY9IdarPEIg5SJ:sxZ87qbT/frsT+oJHbGh0
TLSH
T1E052D6166A385977CCDBD209F945BF53D6F504B2E2940E48A9FCCA0C05E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 55f88f20b60a1819c9e7b507668c8739c4358a151eacc81644c81efc1c0f7f93
MD5 7376117eb2c04ba1b364b05e6413aeb1
SHA1 8c59998c8a91cc5af79c78f2ad9b665e9a7a8596
SHA512 927abd79368438b3abc4f5c577de210ee232af152da273a91b2d9f6472bebe40e8dc92cd5cc4f1589020f399462a15011992ee59bd0629bbff5490a10daaa678
SSDEEP 768:m7cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNlroUg6J:m7cv21wWvu+Z+u1jaeFLeRNeU5
TLSH
T137D20A2B280CCB7E4F841E9CED2AAF8A6DD801CB57988D5447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 afe94e18c6085042f07beecee08c56ad1faf12e3d5113c82846b290187334cbc
MD5 9452384d46bd16a3d4d589928f694674
SHA1 ce567cada02ed9d5ebf1e3d7e2f84355bdafa459
SHA512 467b1bdaaef35a732baa6f3aade29869f478ede567826db87cd17b2061fe38617214e2e1830994e3282a460ec4765144f77edeb2e4f6b24deac3ef7cd7174e74
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDKAIKZSGON2KWwCnr+JFTBBdI9UQqtdKCcH:mT3LVxnr+JFTBBi9UBtXcqzs7z7cQ
TLSH
T130C12502303F0242297D7908B36A8636AF4172677814A8BF7BB910A15F27E225DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f9178e6-2f08-4863-bd1a-e2673cb83493.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7f9178e6-2f08-4863-bd1a-e2673cb83493.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d3070bf6d5c3ef58da4056e0df2516d77ff674947dccaeff6bf87799ebf6789b
MD5 5a494f524172dcb7b38d4cca3833f6b6
SHA1 4c0c58f5bcb1482098fea22b94c4c572ea8f41f2
SHA512 17e59f5ec769509f20b2b4c50dd44526b5052661f38e74b86f1a054c0269367b99dec3b10fae4538a130ff2383dbc875e2e47109feb098c964d3c651780f1ebb
SSDEEP 192:u0LsNpdDQX6L1+YLerpQmiU1urj4e+CG6+FdetRLXx++OJiqqtU8:FsNpRy01ziz6Me+CQdi++nlU8
TLSH
T11732293568785C6B5EE2A640F04B36136FA450A7DB893F90E6EC5F1C01EF69C230A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2799790822b783560e4f2ead7a7cf0a40bc30c7edbea9a99b998997e4f59a3df
MD5 efd80c816e018dc7f3f152820127c3fe
SHA1 0792812553b4ad8786fefbb9c1a1298f7e898ad8
SHA512 96f44cb015ff49db58e91c0bf1bd94394fafe83dfc95a4e3be11cb991fe8a504220f38b468a3b29b9bfcdff1aaf7345c8c8789c3455d878d2509dfc564b68f78
SSDEEP 192:uzLsNpeKQX6L1+YLerpQmiU1urj4e+CG6+FdetRLXx++OJiqqtRXgISYk:QsNpzy01ziz6Me+CQdi++nlDSYk
TLSH
T154522936A8740C6B59E7A544F44B3613AFB490A7DAC93FA4D6EC9F0C02DF69C1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 aa06bad95ae9f490c4fee1a89327fa8ec2627489483cdd523030923e25f79a12
MD5 4ddf8c59434a2aa555e9ad4929ecbc11
SHA1 6f84f3d4da740a477df08de6a8f5cd63496a8592
SHA512 5ace931dec8f64326e5b47793ef4fbab48a7aad25731b416838f9e0100107988dd60694f1d09e8278fb2b6b5dac47631bb20604872ec2dd4f5fefd34993aeeb5
SSDEEP 384:RZcIhsNp3y01ziz6Me+CQdi++nlOObjI9G6w7J0:5htAjn4Exnl29MG
TLSH
T154928D35A8380D779AE7A511F48B39135EF490B7D7DD2F84E1EDAF0D06ABAAC0306416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3550cd0f41cabba19dee29e2088dd81d455166132239957c0bf6040b477b0bfd
MD5 fc11b072cf327d23ddf1c26058e9a6fa
SHA1 598c71e3b04a223e234879dd1e80b60f5a295b9d
SHA512 4798855055f4c8751de11d7f4b5f7dd4e484a0abbfda0658c01b02294169c903ebd786530df6dc33c891a8765f64dd258336c428ffd9b0846abd2e1d38b1deb2
SSDEEP 192:JONB6v+YLNQmiUy/4Zh+CG6+FdetRLusBLTU6:JONB6vz/pZh+CQdMZU6
TLSH
T1FE02EA3568782CAB9BF6AE05F48736235FE4107BEA962F81DAD81F1C01D775C2306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5ea7096677d1fe58412c1e059942d38127b4c78d996efe7bf3b538796958f7e8
MD5 8d3f13da40e07c8422db1936f8a92398
SHA1 ab770417334575124977b0167f491a408500d210
SHA512 8b257fefc8d8b517966fe48296689d8f98e0f7450f300fe8596b381f608c35d084e2385700a93e18ce1bf7b3ab9f29ba7720c8d5068ca690f787846b74cca771
SSDEEP 192:yONU6v+YLDQmiUyG4ch+CG6+FdetRLXx++sCHqqtU6:yONU6vzpmch+CQdi++llU6
TLSH
T151122936A8781C6B9EE2A950F48735135EE44167DB8A3F91E5DC2F1C02EF69C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 e524b16d7a63037b2684c13c3c661780952bcff25305c30f0173bdc138020388
MD5 f35fd1ff4a492bd8fb2338204c3728b9
SHA1 0b5a067f3e4fefea3a139f828d48ae4065782b31
SHA512 f82aaa0b8677812ef1ad15a45d6b6f043cfab62f7213fb964e4ce581e28e3e0063a76583fdd2068d0ddf27a5e7e821158c0833ff10e4269d6fc15531eb4676e6
SSDEEP 384:QiFiZcIXzsNL8TUNTUlIl3y01ziz6Me+CQdi++wlOObjI9G6w7J0:rFQDawgoAjn4Exwl29MG
TLSH
T1B6A27C3398688D7BAEF79A50F48A35139EF490B7C7D96A94F2DD9F0C01AB5AC0306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce68c7e9-2910-4f44-99f8-199907b90896.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ce68c7e9-2910-4f44-99f8-199907b90896.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e0ef5b7dbbca5513dd824118a672804be17e50904e1123ceb2ae9560ab2275e0
MD5 06ab2266d45e0c065d841a8a0c47c1cb
SHA1 b9478af3e81b4c23111c1ffe99aef81cb16b874e
SHA512 6505855703166bc8a486796c69248a709eef30135c331dd7fa3b758022b37d954ecb888fb56f05b1c9f027a1f2fe6a865387cad18e374ce942dc2404c55b2267
TLSH
T103412698B6E91148B3B77F1A9BF6A86E447E7D373F1B906E10110E8F4622A44C871733
MD5 SHA1 SHA512 TLSH

Submit Download