1dbf44ad33bef078badd75a496d4974de756ae8354f6b9b7c143a67a35f21cef

Analysis

user interaction
yes
max time kernel
300s
max time network
191s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1d6WaJY3JhbW9zYkBzYW5pdGFzLmVz18IDpU52.html
Size 572B
Sample260729-scfh7aab65
SHA256 1dbf44ad33bef078badd75a496d4974de756ae8354f6b9b7c143a67a35f21cef
MD5 e84f022438466f11192ea3d60f5710fa
SHA1 018f0a87fa34e18e0f2637788590b3803dc6985b
SHA512 3a4e933a5f3505abdeba1e9c60d0332835e6a97e62afa583a9631376417eb06d07ac994c84906698a98af9837271e12b7a5a9e89ea51a4c5feecfcc82ed4956b
TLSH
T167F0629B5F15287F2E274571F4C35168CF680552FBE925E28348011F76CA0459EB2FAD
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3248	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298107251796054"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{1F8F92C5-CE5E-4867-BE10-3A73206352FF}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2696	1340	msedge.exe	89
PID 1340 wrote to memory of 5480	1340	msedge.exe	92
PID 1340 wrote to memory of 3248	1340	msedge.exe	93
PID 1340 wrote to memory of 5480	1340	msedge.exe	92
PID 1340 wrote to memory of 5480	1340	msedge.exe	92
PID 1340 wrote to memory of 3944	1340	msedge.exe	94
PID 1340 wrote to memory of 3944	1340	msedge.exe	94
PID 1340 wrote to memory of 3512	1340	msedge.exe	95
PID 1340 wrote to memory of 3512	1340	msedge.exe	95
PID 1340 wrote to memory of 3512	1340	msedge.exe	95
PID 1340 wrote to memory of 2864	1340	msedge.exe	96
PID 1340 wrote to memory of 2864	1340	msedge.exe	96
PID 1340 wrote to memory of 2864	1340	msedge.exe	96
PID 1340 wrote to memory of 840	1340	msedge.exe	97
PID 1340 wrote to memory of 5856	1340	msedge.exe	98
PID 1340 wrote to memory of 840	1340	msedge.exe	97
PID 1340 wrote to memory of 840	1340	msedge.exe	97
PID 1340 wrote to memory of 5856	1340	msedge.exe	98
PID 1340 wrote to memory of 5856	1340	msedge.exe	98
PID 1340 wrote to memory of 5076	1340	msedge.exe	100
PID 1340 wrote to memory of 3568	1340	msedge.exe	101
PID 1340 wrote to memory of 5076	1340	msedge.exe	100
PID 1340 wrote to memory of 3568	1340	msedge.exe	101
PID 1340 wrote to memory of 3956	1340	msedge.exe	103
PID 1340 wrote to memory of 1440	1340	msedge.exe	107
PID 1340 wrote to memory of 3200	1340	msedge.exe	108
PID 1340 wrote to memory of 3700	1340	msedge.exe	109
PID 1340 wrote to memory of 4400	1340	msedge.exe	110
PID 1340 wrote to memory of 4400	1340	msedge.exe	110
PID 1340 wrote to memory of 4544	1340	msedge.exe	112
PID 1340 wrote to memory of 3924	1340	msedge.exe	113
PID 1340 wrote to memory of 3924	1340	msedge.exe	113
PID 1340 wrote to memory of 1440	1340	msedge.exe	114
PID 1340 wrote to memory of 1440	1340	msedge.exe	114
PID 1340 wrote to memory of 608	1340	msedge.exe	115
PID 1340 wrote to memory of 608	1340	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1d6WaJY3JhbW9zYkBzYW5pdGFzLmVz18IDpU52.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffe4df3c188,0x7ffe4df3c194,0x7ffe4df3c1a0
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,17423707477842161907,2829357332389865604,262144 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,2496704093090494600,12177471342134372980,524288 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,410265657737190001,7792229666976537353,524288 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:13
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,15553417927988740536,10249384349339610210,2097152 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,14485011775252315457,2757305577769040741,2097152 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,14415965290718811560,15383091835977488440,2097152 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,12850000407291744844,10745509626669838143,2097152 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:9
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,4446822946099060761,10307894350858072930,524288 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,12655723980715895052,5753015138397718939,524288 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,8030742791031120921,1081083293593627803,524288 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,8030742791031120921,1081083293593627803,524288 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,16079202808968844233,6653739500139567921,524288 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,1739586963550951383,4865722827872705069,524288 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,17896278538836676790,12439932359823637192,524288 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2740,i,7632143261280056982,9788003958313086202,524288 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6444,i,8857469422096554241,3528922972066748741,262144 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,8716656305888490226,3836343500662348794,524288 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3168,i,17466018929811045035,16150918813251407077,524288 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,4859099314900594997,10591756540060463981,524288 --field-trial-handle=2052,i,7280121170052965671,2757182201743090620,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:14
  2⤵
  PID:608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

6958d4fb-fbaf-4bd5-93c9-8a1d4064a6de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6958d4fb-fbaf-4bd5-93c9-8a1d4064a6de.tmp
Size 11KB
SHA256 017daaa34a595047e8c1533852de2b777345ff2e95164018f3d06d62366f1693
MD5 7c30a2cd04e537750307fd67d6afdecd
SHA1 443234593b1168667e12f86f3b82e266da9a7d3e
SHA512 4fb249ebced8a4b65f05ea736d865137bed00da0de72ce30f5e94f6f517bea5e8dfc9efce525fe8c4b0c44460bbdfe43f1b8a8f93f2f01d388c9d29cfaade98d
SSDEEP 192:sxRlRQbq/f8sMPprQ5czoA8p4X/g6+WNIYn83P8GJIgIJ:sxRl4q/f8sMPI2/5ITfds
TLSH
T1A432B7166A28A93B4CCBE21DBB157F53D6F95032A1D46E48BAFC971C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3c1e0c01f6f0cc93eab87f2110e79dd45807ebb8707708a2d88420ad0612259a
MD5 961743b263e4eec90d234769c0824684
SHA1 739efdceea8cf9be11384a5fe862c0965be1e525
SHA512 e288f4a1f94b955313171389e3f0210805ddc496e3d7e16a46cd5960ee258bc43369c57d9199c2f0859493d3fc059f63b1012d73bc1f4301c930ba32c3edcc1e
TLSH
T165E026C806C8C22FB710A487477CB31CF2B0364F97C87A4E2748898A7005888A7F36E5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9d1cdc961d28dc016d22c59573e06ace029b73162fbeef6dc664edd0ad5b7121
MD5 7e91a8dd3999352774bb0faf1d97c4b2
SHA1 6c8778a2e5fb668881e3055878060ea6e54e1067
SHA512 14f52d9d69be1b31d77d92b6cf0c3a29a4d2ac61cf9b0039f01fcb709a30af52a8f9fe1f12bc49e88b57dc17bbce594d8df6b0af265b76a11cc9c869dbcbbc3a
TLSH
T1C7512C1DA33614D6E3240772BDD394883FF5CC9A09075E1BA0419EB868C2F17AED2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d6af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d6af.TMP
Size 2KB
SHA256 c17604cd2c1804cca588bf941a2e7ef814b427c341efbc2b5a1721f88f9305e2
MD5 c714dcea4239ec760ea5aa533d772968
SHA1 99e2b04488aff73e3886089fa16bec5c3824d351
SHA512 3f4d6a0a7226e8f196431604947d75b8356b97dbc492e30930dda12757a5cac55fb2ddc2c18808a745121ca89b7f5dd5530e84b6a00d51b7f1d698362e7076fb
TLSH
T191511D5DA37514D6E3240772BDD394883FF5CC9A08075E1BA4419EB868C2F17AED2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fcf73eb5d8549fbe827fbc7acdbbc0892a4f3c693a3d52dace3a2e756a92bee4
MD5 5c6a459fa4021dd209925e0f017f84a4
SHA1 884a5b26952d6ed7ce67b09b296217941356b74e
SHA512 07db65a80eb6ef94125ddedd34081686264101f6fce9adff1913d882b1e140ea880be174bb95384836fd415df992a3cd91334db51d4a3851f02158f8d68f79d0
TLSH
T138419DF7C3E4966E890196F0AB146E1BCE1D0915832C3C5AC9E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 12cd43a6d85908310abc78c55e3975000b2aefcf355b2ff39b29c028acef1168
MD5 105d4bf2d9177cea4174511f504a3f54
SHA1 e5371eafb891a935edd9f0dca0508d1a1e5e4408
SHA512 c2f81342ea4cfe0752a39364468584e08e23229e56540c6a5ec81fa4a7b151ef1fd584b451464f72cf631c2d4367ee7d6ccbfa8b61b0cbb6ec897d5674622b14
SSDEEP 192:sxRWRQbq/f8sTYprQ5czoA8p4X/g6+WNIYn8MP8GJIgDlJ:sxRW4q/f8sTYI2/5IT6db
TLSH
T18542B8166A28AD3B5CCBE21DBB557F53D6F95032A1D05E48AAFC9B0C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 99004200e19a1a4f5e6e1fbc560905a785716dda99e236653fd340fc61b6ecbe
MD5 7164293d69132787b2c3d76a2c904e18
SHA1 7f31d0a5fc7d111364edc222768e0b62d77f0c8e
SHA512 078893965e16da75ca77b1e588bad9c5e9e8f3951a44471c1f2caf1b40d7b0c280c61ba8bdd04d630e0d889190f48ed3dbf729fee18395fac56ef907899fa27b
SSDEEP 192:sxRWRQbq/f8sTPprQ5czoA8p4X/g6+WNIYn83P8GJIgDjJ:sxRW4q/f8sTPI2/5ITfdx
TLSH
T19032C8166A28A93B4CCBD21DBF55BF53D6F95032A1D05E48AAFC971C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 dd79dbe7dc1292d8ffc55e9fa6438d83e367d4d61d1568cbd2da828b3226de03
MD5 a32bf4a53d042f17b86b7275d8b29c79
SHA1 2ebe925b926d9d3fc4e8d2efb4ceefd5dd9cd72a
SHA512 6f806d1ac77bc791a2f49d7dc64dbbe45520e8b54a7aaa02380213752e2b0906b00418a4189c7ec25f348992f24a06bda3ffbf6d29c60b646e4a72f1cf554ac1
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPVrohMJ:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0VA
TLSH
T115B2EC3B604DCB7E5F800AADEC19AFDB6D9802C79A988D4447FE950C02C77EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 40c4f02b76dc2619bbedd400f693793ee19b004c211cbe2395d43829ecafd5ea
MD5 46a4a54062f7388aa39807b2158fdfd9
SHA1 cfd9dfdadca9fbe09c94c0e43a16649b039253e6
SHA512 99081cc2938ca2ae81a7693bc666103bfbf9278ee6ac1528a71895d9df7dd211eddd82b3415e45602f73fd5474b13d292d3fa619d94f2537f9506814276fce12
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHU1gkeCGEWCPvgsEK4hgmEcEkvenKMKFef:CoZs4q26neDsgU1gC/wgziItHU1gkeCV
TLSH
T1C5915A51757B0644383D691C85B8986AD2C2B86270ED79AF3BE841912F67E034FFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a70dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a70dc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 8edef68cf9edc49cdd278d9ab9de5ebe0dfa36ad69c1c0c42049ae07b392c7ad
MD5 ad52b5e65786bac0af3e575c7cb71a0f
SHA1 4a1773e03f9057bbbae8f04e6522109645ef7213
SHA512 61e4d82fe849076f1905d00211b5a29b7df8825d6f52bc12eb3b0189cf0e7c3df0c1ea51247ad6f4dfca00affdd61b09928b7f86d74b1a5ee598545f51369a26
SSDEEP 768:Rrv+4UNbdG3CFDZIO0Z/ANzc4ReyIsPneVH1S5F:Rbsb03otc44bs/EH1W
TLSH
T12B13BE32E8789D77ACE66681B50775533EF5921782C81B94C9DD6F0C0A8B1EE131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 3d4b3d887527303bc21f287e3f6f8f072ddd2c3c41a16617a199966d5561c2b5
MD5 852ff33567a1dc204a0bb7105df3756b
SHA1 f7a3439f7a4d36a8cf7754ea69797498839b00e2
SHA512 34883a8ef012aba74e74374f84ff56f610b8a034b8c8d0ce923eb7ed60e267e491214420d05a873c46992a74a46ebdef0c31d8b1e462fc2d3bac0c68ff782914
SSDEEP 768:9FQt3iwgWFDZIO0Z/wNzc4ReyIsPnMjSH:Mt3Ztc44bs/ZH
TLSH
T16303AF33ED64C96BECE99B45FA063252AEF14263C5D4AB94DADDAF0C05471ED031BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 57551f03447185f5d643c8bddc170cd4249fb8a57ced04119f087bdb65b5ec74
MD5 6995c94516123f92de2ed449b2b9aae7
SHA1 360770ad826cb9063bb27fbddf39c2062fca014e
SHA512 de2046d5603f59859ee8500cf548521c4d7ee173c211efd09d1a326ebdb237ead55fffefd30bed45a0a8748d1c1d33085526cd84b9be5ece213c9ba96b3bd81a
SSDEEP 384:9ZcIzR38NXdoGKIiNhJDZNfNoXOVSUURXvFAiXSFaETRzcoXfK86sfxEZxxsIj49:ll3LFDZIO0Z/ANzc4ReyIsPnMjSH
TLSH
T166F2BF33ED349D67ACE9A745B9063652BEF59223C2C86B84D9DDAF0C05875ED031B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2f78635cbc084f0e005aa7ae556f2b83feeb983dd7f63a7c4ffdb684145f5f70
MD5 383d091aa718ae917d634e154d753de8
SHA1 8d8fae26904ebc3ee0d9e6bdc7ece855455a98e8
SHA512 c55a4ca368a8a224d5e18f3bc5ecc3e2dfed0726ed52721305b62066c230b7802e42de2c2d91662157e6c5360e76fb1a3ec499aad16208069373a61c1a8d1f05
SSDEEP 768:6rv+4UNbds3LkDZIO0ZaNzc4ReyIsXveVH1S5D:6bsbS3stc44bs/EH1Y
TLSH
T18A03CF32E8788937ACE66785B54B76533EF8512782D81BD0C9DE6F0C4A4B1ED131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download