hxxps://github[.]com/Rb-gif/virus-database

Analysis

user interaction
yes
max time kernel
251s
max time network
254s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Rb-gif/virus-database
Sample260727-169ccseq71

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3972	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296642359329093"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{3BB1D7AB-6EE0-44D8-880F-0A7476EEB1C9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1504	msedge.exe
1504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 1184	3300	msedge.exe	89
PID 3300 wrote to memory of 908	3300	msedge.exe	90
PID 3300 wrote to memory of 3972	3300	msedge.exe	91
PID 3300 wrote to memory of 908	3300	msedge.exe	90
PID 3300 wrote to memory of 908	3300	msedge.exe	90
PID 3300 wrote to memory of 2780	3300	msedge.exe	92
PID 3300 wrote to memory of 2780	3300	msedge.exe	92
PID 3300 wrote to memory of 1364	3300	msedge.exe	93
PID 3300 wrote to memory of 1364	3300	msedge.exe	93
PID 3300 wrote to memory of 1364	3300	msedge.exe	93
PID 3300 wrote to memory of 4540	3300	msedge.exe	94
PID 3300 wrote to memory of 4540	3300	msedge.exe	94
PID 3300 wrote to memory of 4540	3300	msedge.exe	94
PID 3300 wrote to memory of 6104	3300	msedge.exe	96
PID 3300 wrote to memory of 1300	3300	msedge.exe	97
PID 3300 wrote to memory of 6104	3300	msedge.exe	96
PID 3300 wrote to memory of 6104	3300	msedge.exe	96
PID 3300 wrote to memory of 1300	3300	msedge.exe	97
PID 3300 wrote to memory of 1300	3300	msedge.exe	97
PID 3300 wrote to memory of 3916	3300	msedge.exe	99
PID 3300 wrote to memory of 3916	3300	msedge.exe	99
PID 3300 wrote to memory of 2428	3300	msedge.exe	100
PID 3300 wrote to memory of 2428	3300	msedge.exe	100
PID 3300 wrote to memory of 1448	3300	msedge.exe	102
PID 3300 wrote to memory of 5092	3300	msedge.exe	106
PID 3300 wrote to memory of 4624	3300	msedge.exe	107
PID 3300 wrote to memory of 2112	3300	msedge.exe	108
PID 3300 wrote to memory of 2068	3300	msedge.exe	109
PID 3300 wrote to memory of 2068	3300	msedge.exe	109
PID 3300 wrote to memory of 4520	3300	msedge.exe	110
PID 3300 wrote to memory of 4520	3300	msedge.exe	110
PID 3300 wrote to memory of 1504	3300	msedge.exe	112
PID 3300 wrote to memory of 2940	3300	msedge.exe	113
PID 3300 wrote to memory of 2644	3300	msedge.exe	114
PID 3300 wrote to memory of 2940	3300	msedge.exe	113
PID 3300 wrote to memory of 2644	3300	msedge.exe	114
PID 3300 wrote to memory of 1700	3300	msedge.exe	115
PID 3300 wrote to memory of 1700	3300	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Rb-gif/virus-database
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d0,0x7ffb7cd9c188,0x7ffb7cd9c194,0x7ffb7cd9c1a0
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,9752048077867835358,9841847778824002426,262144 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1668,i,4413675547258469973,1120677438281727415,524288 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,12617349329823574001,2578017949598858244,524288 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:13
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,8458075792911928057,8191106269313322351,2097152 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,1771647586086286799,824315390984191762,2097152 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,7441143598904578208,12499265317166892413,2097152 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,12253959229492639972,2370294863095200197,2097152 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:9
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,13147676264810577738,8314794471411426176,524288 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,12948920393991505005,6813339302913301302,524288 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,4707227761747263724,10798830478297414603,524288 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,4707227761747263724,10798830478297414603,524288 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,14877415500748516719,17323191082368469218,524288 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,17296553346407042240,15512548540301058517,524288 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,2856461409182149258,2200986041820637629,524288 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2696,i,4384922186615997159,18432501216497236399,524288 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:14
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,6409774845925509743,9930556406850026419,524288 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6492,i,14600565845766533933,574622864377903913,262144 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2724,i,8326127494263214061,13037385661869202860,524288 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:14
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,10771612788031742682,8779910779213972333,524288 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:14
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,12792366563471227308,11118279215683550601,524288 --field-trial-handle=2348,i,379722646235657094,13939469978003331777,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 175c72332ba31722b5a125116d5e96c233a259250b6a63a576e9035d58f6c244
MD5 e5de5e599a12cc0ed8639f254814e3c5
SHA1 3312eff1ad02056bf4cc449e31094be93b805b77
SHA512 f66ea99d8e298bf01635f02d28128525e2652402988f0a9a136458c4054115212ef603b2f46cdf7332bdb33aa31492d715d103ae087021f5b2e8d3d714383dc2
TLSH
T1ADE07DC514DAC32EB322645B43A85B9C9291370ED7FA691A171C888C7082440F7E7EF0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 32d3571d1e88dc1faa9044b5875ff50cb257613937489f24c995b6e0f333f69b
MD5 92c117a6e7b724c988f3e00bbf22a624
SHA1 5a1ada747952c1be677c21f16ffc03c0f78628e1
SHA512 cbac5602d50a5eb84250afcd5983afb5dd473cc19ce8abf9a7ae353e6eed0ed3b2de3adbd42a071918b7bfe8814187dddd8c6233f3cdacc8103a377d19dd6b0f
TLSH
T1C3E07D9904DAD3BEB301748741B9430CD2C2364FD7F8A91A170C88C97082454B3EAEA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 593185acb4c674e9134595bf40d47f38f2c4ee201b82a318d1b667ff4c5059b9
MD5 b64ecea646813d94cac310eb3a614cfc
SHA1 0b74d708d518defc46f24f79e3c7c193f26be6fe
SHA512 3b37face91d339fe77c881fccd3ca9e34926da46dfc2d46c023787701270451ffbd8fc707521bbd4a93f5b9e282a22f71906fa5a6eba56d05c0450d749e6add4
SSDEEP 96:eDqdO1revlBgZ/g8vKWrGEWBUchF0eMHQSrG:eWsxR5KW3eUI0o
TLSH
T16CB13BD0C70F0892DF6AA57685D28AE63EFC85BC422F7E9C8C2C5474DA42B646352477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 556da5f7db039233ba872df70df2174d24d3d551779376b79d5b4a931ade7cd7
MD5 8f3877aeb281a6bd9f7d9e7f6a9c62a6
SHA1 ba3d3efe0e5b8e92bc3f4380a24afd70eb734fa1
SHA512 1322792cea1e27ea6816290adf740693875c33d34ea7a10c4dacc173501eb25f36e96c6ad3313d59310de955347e21ea95211b9363267e36d001139288dd6173
SSDEEP 48:Cikiydfl5pBAMwz6ya2yiBSHBOOKjfrW4FFPzW6+WsOe9lslZ/iEoEzbeSQrKeUu:CiNoRVZiBKBSjfC4FFi36lZ/0gt2KU
TLSH
T138A119D4C71F04C1CF7E25B685D28AAA3EFC85BC023FAFDDA06D20B49A46B245312526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59e0b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e0b2.TMP
Size 2KB
SHA256 4a90bc467060fcad3383055e9e73144607fa4cdefd887835e814c9dbc6d75c29
MD5 807967c11b63ac9281381c18a9feea92
SHA1 ccf903a8b0ee57e6c4bfa3b322574412c4aa9402
SHA512 89b72c59eca4dbf3c96d89a5167b0b28ca2ed5d82414473e8f52efb7bd2ef21c01b09e0c5c79d42fd00202ad507d5205b19a26314ca00683533eb15e54214c46
TLSH
T15D41FE50472709C1CB3335B7D9E1CBBA3EFE84BC4603AF1D80B4A2B8AA06F345012232
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 447e4707740fbde4c553cc0b68006c70e839860d9d3941862287aa547f557449
MD5 4aa056633ec9996b7e4a702757aaf4c5
SHA1 148545455be2c8f2b185bd4129c18d030f0fa4e6
SHA512 28ee5951ec4d7122473ce41d3e7df9bf751701b36211da6ff40c9da89292f4aaf1048881c9e1f95e08cd1ea21393cbd697ea645d7be032b858ac9ce32b2f76b8
TLSH
T12531CDF3C6E8563D890142F87A143E2BCE2D0854832C3D5AC8D4AF5FA3E1871D28094E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ff0f9d5c9a0f3aca5e656592849eb3c927dbe1883eb81c23f42d516071e94493
MD5 c9962f474285816f6565089f3e740a44
SHA1 2a5796396cad925b4f07b37fd483871e9aa92d1f
SHA512 968639eea88bb5530b9ce579eab1583f0efb5810ddb081c1324af83ccb88106bcebbda5ffb60ac3f5d5fac5f3c6bc85ee882caf07a889f99bbac7f5178fb9a51
TLSH
T12F619EF787E5866D8A0155F0AA14AE2BCE2D0515831C7C6A88E4BE17E3E3871E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2ac3fc9a36bed9449d4139398ca61188195d7345b25e56c74c9492222143c9d9
MD5 e21d28e6d5b3ee2febd7e213d0f7312a
SHA1 c0f831dc14e81fece3be727ab77d84b30f2b9fc7
SHA512 61e2872fc814d2904f4bc16b80882fc4e78eb7e84e465a1bccc7c8511be13c56b895f84f34d22f31d7f4c1e0b232f769dc5cec5511ec0b1ba03b66a6d5bd6a0b
SSDEEP 192:sxRTRibr/fRsO33AtGzoA8pyTe/g6+WNSa+/YZFLYDG4IgZJ:sxRTir/fRsO3or/5C/SUD
TLSH
T10D42C4166928993B4CC7D21DBB55BF53E7F92032A1D16E48EAFC8A0C14EA7DD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 74a4c9ab4fea6312359b306e23cd379653972ef30335bc57bd662e32663cb5ee
MD5 b1a432aa35f3f5ef5df35f2c66a090e6
SHA1 734102570679db1aa633aece63cfad654ea470d2
SHA512 4ca18af25fdc6a509182cbb07c740d03a5dbce6a48b6f838fac838d3027047df333c01e1063e5e74e2056740cd501426cc5f02465d55b553da6e5a0691e0d8d6
SSDEEP 192:sxR0Ribr/fRsk33AtGzoA8pyTe/g6+WNSmsXYZFLaDG4IgDgJ:sxR0ir/fRsk3or/5oXSmQ
TLSH
T12A42B4166928997B8CC7E21DBB55BF53E7F92032E1952E48AAFC860C14E66DD630340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d8e6e58001823c848e3ebd119ac46706c7a386c9a5d138b0d85ea8e067dc3221
MD5 4c58a7984c640f55b10c88e89dc6c65d
SHA1 eae6699155df8583ff3b864fbff6809cba6bd7f7
SHA512 466ee6d3d7e75d55451eae0ed0663a2f4f59cb86e56c3bc859006fcd153babae2af8c309675b5c8e39034c352a3d6c7d90e6e9ae6b9808c42a2e0a7b58065149
SSDEEP 192:sxR0Ribr/fRskF3AtRzoA8pyTG/g6+WNSgWZYZFLgQDG4IgD2J:sxR0ir/fRskFRf/5sZSgcO
TLSH
T1CA42D5566928997B9CC7E21DBB56BF53E7F92032E1911F08AAFC870C14E66DD630340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 cce27d022c490bf006d9cb218c523bb6463be621874653aa51c1c29fa0a0288b
MD5 f22430a379d8dc7ae8119193daa94b3a
SHA1 cea1bc01d0d45b7e02e7f433cc38ce551a8f4dcf
SHA512 0a9f0cb1d5752fb1964b4fde0576bcfeb2533721a4c140db6aae943aa8c0b23036ebab6bfc4d039099542a459ae338c3b5a063ec4109ecbad496a864eef894d8
SSDEEP 384:KAX0EdqfCtgNbFfVNKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVui9LZRGjrocmm:K80EdwWgNhfVN8F1+UoAYDCx9Tuqh0V9
TLSH
T133B2BA3B640DCB7E5F800AADAC196FD77DA802C796988D4047FE994C02C77EA91294DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a6ec9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a6ec9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a67488de11bbe7c2010385a98bd9c855c16994dc42ca6418ef12d447ec45a212
MD5 ebbbf0e47608ee585733aea199d0f138
SHA1 6e60e52266140a814ae5fcef3940eeab791721a4
SHA512 828d10e246ec2a6bef5d6eeadc21ffdcf03642d92ff384886177e4ead3c931c21e482618a86d5a09254cc0b6bfd355db533ba44419e29d8a7ba7b9bfe59825de
SSDEEP 768:T33iLY+LeSFOUJmX4fouOToPvB2thtA9VAgob9Moa:T33Psnnwthttxb+oa
TLSH
T1C9F2C072ACA88D73DD96D3A4720E32526FF09123D6E41F8459DDA70D0A47AED870BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 1f4a1ce1d340cf0a2a95f53b7b62b412d8a2cdf8744712b6f8d8398d93cd07dd
MD5 c755e0d2092847b255d573fa39070a57
SHA1 92dc7448740c810feb8fe6e2c81145e5c01ee86c
SHA512 33118def30071271a56ed039dd8387077b86ce78ad3a292d03cbb291c3a84e2f3e8d0904e99bfe2e621291484ff275645e9ceafa396d67d099bd3c120f2427a2
SSDEEP 768:jFQw3Rwg1LY+LeSFOUJ8X4fouOToPvB2thtA9VAgob9Moa:Gw3csnnwthttxb+oa
TLSH
T1801358F288D78933D9AE8797633D2E125EFCC163B5945A8077C8960CCD465BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 22bd028dbdfeb23f400870ae2d2af0e46cb452b9ef6368d64f671d41a341fb0b
MD5 8df5a510d86554b6e522078b9620fdb9
SHA1 0b37ff3c7bae5b2ca6afc26fc5367001f4ede80d
SHA512 5e5925684c83524118bf71cd673b85f3e8588265e248cccb964ec05a8bc2d895015253b5e9eecea1753c853acaeb32a4ed2c3ab1d41c66568b612693766e7822
SSDEEP 768:D33+LY+LeSFOUJoX4fouOToPvB2thtA9VAgob9Moa:D33nsnnwthttxb+oa
TLSH
T137F2C072ACA88D73DD96D3A4720E32526FF0D123D6D81F8459DDA70D0A47AED870BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3f4f1c94b3ba298b798fc2cdb473ec4b878ab084fa930cddfc15d8ed8c0b9e9a
MD5 c87be03d87cd77758c82735d655564f8
SHA1 4068925e43fff5d3577ae79f00ad5982695425d4
SHA512 d591fc19205e3fb3b80b79aa669ee627cf3ec59667447a4e191ad790f7b755feb844ce98cae847dead0a617cb3bfe36768243010d7b86a68672a7bde3664919f
SSDEEP 768:grv+4UNbdH3QI+LeSFOU5X4fouOToPvB2thtA9VAwdeVH1SlX:gbsbh3ssnnwthttIEH1Y
TLSH
T14E03CF32A8A88A33DDE6D398710B75573FF491639A900FC499DE1B4D079B9DD070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c7a233b-5d2a-46d2-90b3-44415c0b9732.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5c7a233b-5d2a-46d2-90b3-44415c0b9732.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download