8df34860aa5da18e489d457d3f70c88c73cb04e647bc7c9a74d7cf4948a5b011

Analysis

max time kernel
300s
max time network
198s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IT9248358009143.html
Size 21KB
Sample260730-dvzbpaycpd
SHA256 8df34860aa5da18e489d457d3f70c88c73cb04e647bc7c9a74d7cf4948a5b011
MD5 4d2feeefac722d5c3c7f8beb00b7832b
SHA1 74bfa298ac1764761c011b30369acda4d656bee7
SHA512 1caf5d6c9584b6b28ac208c0f338f0a48d7c34cb17783ae09ccdc02fabdd71f993ca44e36ecbde8c33321d89a7e54b20897116deac0cf59836a258fa09d390c2
SSDEEP 384:Tm/3VFMc3FFm/oMaWYXJM11xF9UvaNkdd/ifVqvmnZRT0/tf1HnuqvORu:RKvaAi9qvmnZRT0ldHnuqvp
TLSH
T13CA2F96AC4860C275D0767896FCB92D31678C503AB468B25BAFEA34DBF410CC9F93758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4852	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298552403420519"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{00A8DC8D-5594-41E0-B158-9027312F9A12}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 5456	4356	msedge.exe	89
PID 4356 wrote to memory of 4852	4356	msedge.exe	91
PID 4356 wrote to memory of 2016	4356	msedge.exe	92
PID 4356 wrote to memory of 2016	4356	msedge.exe	92
PID 4356 wrote to memory of 2016	4356	msedge.exe	92
PID 4356 wrote to memory of 2352	4356	msedge.exe	93
PID 4356 wrote to memory of 2352	4356	msedge.exe	93
PID 4356 wrote to memory of 5828	4356	msedge.exe	95
PID 4356 wrote to memory of 716	4356	msedge.exe	94
PID 4356 wrote to memory of 5828	4356	msedge.exe	95
PID 4356 wrote to memory of 5828	4356	msedge.exe	95
PID 4356 wrote to memory of 716	4356	msedge.exe	94
PID 4356 wrote to memory of 716	4356	msedge.exe	94
PID 4356 wrote to memory of 3904	4356	msedge.exe	96
PID 4356 wrote to memory of 5652	4356	msedge.exe	97
PID 4356 wrote to memory of 3904	4356	msedge.exe	96
PID 4356 wrote to memory of 3904	4356	msedge.exe	96
PID 4356 wrote to memory of 5652	4356	msedge.exe	97
PID 4356 wrote to memory of 5652	4356	msedge.exe	97
PID 4356 wrote to memory of 4184	4356	msedge.exe	99
PID 4356 wrote to memory of 4184	4356	msedge.exe	99
PID 4356 wrote to memory of 944	4356	msedge.exe	100
PID 4356 wrote to memory of 944	4356	msedge.exe	100
PID 4356 wrote to memory of 2740	4356	msedge.exe	102
PID 4356 wrote to memory of 5820	4356	msedge.exe	106
PID 4356 wrote to memory of 4952	4356	msedge.exe	107
PID 4356 wrote to memory of 2372	4356	msedge.exe	108
PID 4356 wrote to memory of 1472	4356	msedge.exe	109
PID 4356 wrote to memory of 1472	4356	msedge.exe	109
PID 4356 wrote to memory of 2324	4356	msedge.exe	111
PID 4356 wrote to memory of 4468	4356	msedge.exe	112
PID 4356 wrote to memory of 4468	4356	msedge.exe	112
PID 4356 wrote to memory of 3040	4356	msedge.exe	113
PID 4356 wrote to memory of 3040	4356	msedge.exe	113
PID 4356 wrote to memory of 2908	4356	msedge.exe	114
PID 4356 wrote to memory of 2908	4356	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\IT9248358009143.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x240,0x288,0x7ffb221ac188,0x7ffb221ac194,0x7ffb221ac1a0
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,3985013857097889980,2930139470277032317,524288 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,3501354440530505918,3919812744524918308,262144 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,11058902303405665429,17634654970071834969,524288 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,9686272744389474752,15411936380926548311,2097152 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,6936705391513469833,5442848465095931972,2097152 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,10816925503755429215,4962117492673994348,2097152 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:9
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,12299724974767370521,15706408781327109390,2097152 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,17579393719582028824,8678197642053908349,524288 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,13292722420597378668,13278182139930339753,524288 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,10813745801972633673,9431110056108379070,524288 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,10813745801972633673,9431110056108379070,524288 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,12357434108828808110,11506042158221271570,524288 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,18223412641932332747,4286027116536974269,524288 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,2130412386377652228,14866500239249656572,524288 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,16104202297399470289,9812973013363899061,524288 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3236,i,348014597660481864,8205640376434655007,262144 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,15512980155999762705,9621587765343340989,524288 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,10359697720167226096,3004633312584257372,524288 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,17339195073574285476,13874167707497493290,524288 --field-trial-handle=2316,i,2181832709102707175,7760732239465857830,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:2908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 52d2a229d3457ebcd7017502160cdf0cbfc25826e47f676b63e69b2769e1fc4d
MD5 f25792b9ebd2031b5246bd3dd1dadb4e
SHA1 bef52c89e002b3652541d71c2e1cea20474b6482
SHA512 4f8b40c75882c6dcc7ee77e7c5186a0f8d7f68c264af0ea743c9dc8da3ad85baf75204754690e077425b97cd334b08bc60d8cc985a00cba6fe66586bb7eb78e6
TLSH
T1FCE026E885CAC36EE245748B4368578C82B0360FDAC87EDA1B08CC8C7342840E3E26E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a1f0ebef8a4e37ca0e3d80754b0eb7ccf8eae6f589be5f20b743e09feb639b86
MD5 4ac3be864372a24b8454a0ad2756aa4d
SHA1 d3f7b2763798773f35fb57a4d7614b5c7cd66b44
SHA512 3db187e137179a1c6a1e6590e0538fe4402938f060c95a11dda49c5f7c75b483ec8891055afceca36822cd1e6871440a0bacd42498b3ff736d07e489a55f8c8b
TLSH
T194510D94132E0BF2C79CDE712DE9AAF8B5B588E9038B6A10D37155B8DB227F4A752010
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5978d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5978d0.TMP
Size 3KB
SHA256 b663e2cd27cd173108ea363ef818b43bdf5c4c11a3631656b40a1494a344000b
MD5 0b310734f449bdffd9ceed7d865bc648
SHA1 aeb340a5c8bc8b0acff53041acfc7162f4cc754a
SHA512 71e2b392af858c275ac81cab1d2ad4fc961c27c56a3d916e03bf4f65501e47d4ccaba0e24ad3f061553675548fdf92c5bcaab7f2133ba99cfdbd4b0a8f4a8d30
TLSH
T119512D94032E0BF2C79CDE712DE9ABF8B575C8E9038B6A10D37155B8DB227F4A752010
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a6891ff-f63d-4178-999d-3201b1485ac3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2a6891ff-f63d-4178-999d-3201b1485ac3.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d9a5fa6f21b4215947353c6181fc1db71cfb8d1301e17c56acfe3fe671076544
MD5 04154af3d6125adc8838ca0266e0fe6b
SHA1 d792bf3a46e02e5facff99300978209e0b5840cd
SHA512 6e31a6d24bad40f87f00434cb335c6bbd4578fd028bc17897d19a408d42f66de45e6ee203c29275af6782f58bbfaf59a1a917610e7f857739269435c72f442fe
TLSH
T13341CEF3C3E4896E890156F4AB146E2BCE1D0915832C3D5AC9E4AF1BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c5668e0b58f541c8be1489264d8b647381a30e975157fff115f82a966b8381d5
MD5 647b54a2e594ead1bb26f6d119713a0a
SHA1 490694815d12c5b67a637030db4cfa7dcb7867c7
SHA512 683cd04bae949e5a266b262316d8907e3362cb6c28c6b0e92a122547ab01eb8009fb89fa1c4524dfa9aa14214d2bc2549a5235da8c1e9aa74fe160df444f1b86
SSDEEP 192:sxRVRQbv1/fOss2/MjMzoA8p4L/g6+WNIYZ7PKs3GkvN9IgIJ:sxRVQt/fOss2Ej96/5I6XvNhs
TLSH
T1AF32A7166A68993B8CCBD21DFB55BF53E6F95032E1D02E48AAFC861C04E76CD220750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3990c6afd825ea8be1b3063838bbd382a7cc50e06e286b0c05b252c23bc644fc
MD5 be248976cd7499441a5b08823366bba8
SHA1 a061e56a0bd514b2bd23b6423a69f46d7a53b7e5
SHA512 36d5f87bf909f47f7210d9b06a5b5cf4aa803eb3370e1cb3e334490704395b642ffec9a6a89d57e214d1b3da68557e10d02e6f166829886d66fde6381e312fdb
SSDEEP 192:sxRaRQbv1/fOsisZ/MjMzoA8p4L/g6+WNIYZ7P1s3GkvN9IgDdJ:sxRaQt/fOsisZEj96/5IvXvNhD
TLSH
T10E42B7166A68993B9CCBD20DFB55BF53E6F95032E1D02E48AAFC871C04E76CD220750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9410cf17434e182a857827aaccff21fdab29352c2c4739dbd7700eb2537e3d97
MD5 4e4e8ab7b419027f4d33daccad37abd7
SHA1 2a0ac94e447f52a8f45771906fc99a913dacc7f8
SHA512 6a5ff7f7d568968c939bde8f3971a51c82d71c299ffb4afd30499361d2fdcc2976008dce90e331b7329c40674a01db980c0b3438a6d16176a11a9f751fd0da0c
SSDEEP 192:sxRaRQbv1/fOsi2/MjMzoA8p4L/g6+WNIYZ7PKs3GkvN9IgDLJ:sxRaQt/fOsi2Ej96/5I6XvNhp
TLSH
T1A332B7166A68993B8CCBD21DFB55BF53E6F95032E1D06E48AAFC871C04E76CD220750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 596605ad0a5e7926e072438910897996da055fb899b3f41071bc1f03133f6527
MD5 71056c66d8b61f1a144f7c6df5e4c150
SHA1 1b79801598f59d54e8c90c23f55670714ce1625a
SHA512 50f3f9f6bbd88d416502e0c06d6c6ec257ba4d565bb3aa38f4f6c1681c4176d5360b7a6becefe71eebf7cf0f1aa34d8ecdbccd0f628b8be3839aa8d81f2c4e33
SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR6groOpi:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0V7
TLSH
T188B2DB2B604DCB7F9F801A9DAC196FD67D9802C797588D4047FE990C03C77EA912A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1157.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1157.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 e456954c63efa7db8e35a5e66a7855d2376597a7558c32547e8e5a3ed67c56a0
MD5 dd976fb61bff73d9d6cb714defc8eafd
SHA1 493e15960c081b558318108638f6455d7f78df97
SHA512 1e787e46598da4a6509d5429ff116c7c588ecfa000991ee51ef0061cc0360cb039bb4e0abb47e0a7da2bfbfe4e0e2d597d9652c0e639f72782a4d8d48677c310
SSDEEP 768:jE3imsqHLDLGWpAam6aQMGdjWca4Ghf9SJl:jE3EWbmaME6pSP
TLSH
T1F3E29E326C6898779CA79295F71B3643BEF09163C5CC5E84C8EDAB0D029759E230BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 809181098f0f88104ec15ffc81820cab9889e28761e32b4b015cbe1efcaa0cab
MD5 3edfb35bf44f19138899441accbd35d8
SHA1 1474948027b04c7a2185feb4462e5b69f2564437
SHA512 2b331cbf262a3bb8c1c7454059fc161688f81a6e5cd9622e5970688a02f43dc87090e6a3f233b18d10366255ac657aa2bf15a74030bf814180b33779fae74e91
SSDEEP 768:/rv+4UNbdj3RksqHLDLGW2Aam6aQMGdjWca4Ghf9Sby:/bsbF37W4maME6pSW
TLSH
T1AAF2AE32A868D9739CB79695F21F7683BEB45163C9C85E84C8DD6B0D039B09E230BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 770d6bb91a336a0da215012eb17f2fb2df20ed8f8f28d91223ea464f0f65983e
MD5 e44b2099ff973c974c9adfb9a9aa91c6
SHA1 b04ddb991032d438e44730b8c39a9d5c8d9dc973
SHA512 a9885072bcffe55ecd42601c6b39607ce576584919b6ca98a5901adde718f35c380ca4b0080d8b44d8dab7444c43bef716707b94df9972599a9ccc45d2fd823a
SSDEEP 768:VE3RmsqHLDLGWpAam6aQMGdjWca4Ghf9SJl:VE3pWbmaME6pSP
TLSH
T160E29E326C6898779CA79295F71F3647BEF09163C5C85E84C8EDAB0D029719E230BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 67606f18dc7daf501c989bafe20c9071911caf86378b534e2f330ab816ad3e01
MD5 acca77a1eb818fa59875574cae86f8bb
SHA1 175e775f991ee0be6709dc01141d393c704d0e6d
SHA512 14835d7c1bc25c1d83eaaab3b54a611463228062fb4fee1c02056c88bf5204443b141d543a0240712cf863dd1f949590dd63b27888c80b2d963694833b746102
SSDEEP 768:bFQ934wgPmsqHLDLGzAam6aQMGdjWca4Ghf9SJl:u93SVmaME6pSP
TLSH
T10AE28E335C98C9779CB79B95F71E3243AEF041A3C9D8AE84D6DCAA0D029718D130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 94e98f361fdcb045fcc0c3dd85ac7acaffd1a8e3f5cc6d77089b0e9d6937b719
MD5 e977345b2c40fedf92795572df784418
SHA1 d90d2bcf424a68bd6f5ae86ac25f48b453d9d70c
SHA512 5e77ab0f6894ef34db2940c417b6615d7a99155cd5340247a8da8c05a805f1c98e6918eb7d10636b92e5ff86e53ca677784edaf6961a64ad42f1c4fe7d1b93f7
SSDEEP 768:/rv+4UNbdq3kXqHLyAAam6aQMGdjWca4GhfBWPeU/:/bsbc3wKmaME6puH
TLSH
T144F2AE31A86C9573DDB79A99F21F6787BEF421A385D40E84C9D86B0D439708E230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bac543da-625b-4ae3-abaa-f6cee669dc3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bac543da-625b-4ae3-abaa-f6cee669dc3d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download