hxxp://83[.]44[.]3da9[.]ip4[.]static[.]sl-reverse[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://83.44.3da9.ip4.static.sl-reverse.com
Sample260730-lkwrtafb22

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4636	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298777857439437"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{44262168-290E-47F5-90BC-2312CA9033CF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1752	msedge.exe
1752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 1804	3660	msedge.exe	88
PID 3660 wrote to memory of 4636	3660	msedge.exe	89
PID 3660 wrote to memory of 2540	3660	msedge.exe	90
PID 3660 wrote to memory of 2540	3660	msedge.exe	90
PID 3660 wrote to memory of 2540	3660	msedge.exe	90
PID 3660 wrote to memory of 4424	3660	msedge.exe	91
PID 3660 wrote to memory of 4424	3660	msedge.exe	91
PID 3660 wrote to memory of 3820	3660	msedge.exe	92
PID 3660 wrote to memory of 3820	3660	msedge.exe	92
PID 3660 wrote to memory of 3820	3660	msedge.exe	92
PID 3660 wrote to memory of 4924	3660	msedge.exe	93
PID 3660 wrote to memory of 4924	3660	msedge.exe	93
PID 3660 wrote to memory of 4924	3660	msedge.exe	93
PID 3660 wrote to memory of 4064	3660	msedge.exe	94
PID 3660 wrote to memory of 4064	3660	msedge.exe	94
PID 3660 wrote to memory of 4064	3660	msedge.exe	94
PID 3660 wrote to memory of 5112	3660	msedge.exe	95
PID 3660 wrote to memory of 5112	3660	msedge.exe	95
PID 3660 wrote to memory of 5112	3660	msedge.exe	95
PID 3660 wrote to memory of 3896	3660	msedge.exe	99
PID 3660 wrote to memory of 3648	3660	msedge.exe	100
PID 3660 wrote to memory of 3896	3660	msedge.exe	99
PID 3660 wrote to memory of 3648	3660	msedge.exe	100
PID 3660 wrote to memory of 3692	3660	msedge.exe	102
PID 3660 wrote to memory of 3884	3660	msedge.exe	104
PID 3660 wrote to memory of 3884	3660	msedge.exe	104
PID 3660 wrote to memory of 3884	3660	msedge.exe	104
PID 3660 wrote to memory of 2172	3660	msedge.exe	105
PID 3660 wrote to memory of 2172	3660	msedge.exe	105
PID 3660 wrote to memory of 2172	3660	msedge.exe	105
PID 3660 wrote to memory of 2220	3660	msedge.exe	106
PID 3660 wrote to memory of 2220	3660	msedge.exe	106
PID 3660 wrote to memory of 2220	3660	msedge.exe	106
PID 3660 wrote to memory of 2104	3660	msedge.exe	109
PID 3660 wrote to memory of 2104	3660	msedge.exe	109
PID 3660 wrote to memory of 2104	3660	msedge.exe	109
PID 3660 wrote to memory of 1744	3660	msedge.exe	114
PID 3660 wrote to memory of 2796	3660	msedge.exe	115
PID 3660 wrote to memory of 2568	3660	msedge.exe	116
PID 3660 wrote to memory of 3972	3660	msedge.exe	124
PID 3660 wrote to memory of 3972	3660	msedge.exe	124
PID 3660 wrote to memory of 1752	3660	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://83.44.3da9.ip4.static.sl-reverse.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b8,0x7ffbd12cc188,0x7ffbd12cc194,0x7ffbd12cc1a0
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,14472568858116754975,9763227900582904673,524288 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,18273683108296108101,12740790009524792918,262144 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,11159366294777619447,6119353186213408409,524288 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,11822402295814006405,11970348142213745677,2097152 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,3182971447003363269,13111491470228927200,2097152 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,13728285595636163422,596589174129179889,2097152 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,3216036875603874578,2265049016316005206,2097152 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3312,i,2757350503759544367,1853545536436181714,524288 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,846266989646653549,5345612391656935704,524288 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,16839155223031365904,10816379939534208266,524288 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,16839155223031365904,10816379939534208266,524288 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4764,i,4813318578318418601,18092670705649076825,2097152 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3684,i,10098828040093864684,15031944721368807091,2097152 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3652,i,11708736918709403336,14086818515857059298,2097152 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=2564,i,11244760892812380418,12687728027529559853,2097152 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,17952441534707971189,3301681382369026695,524288 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,2062868065917323961,6465302456154026812,524288 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,12255580054934130459,17983878388177119643,524288 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,7243889324833934070,823578269334624104,524288 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6120,i,1124997733948723972,2652243441006576072,262144 --field-trial-handle=2240,i,2660676445675227902,2033138723757454475,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 c433aef5d150ea40890d9c40fe67c2b54b72125efd1a7e533338c440074bbdf0
MD5 1811f89d18da6cb5e5010cbae7cde7e8
SHA1 25870d53e0ed8ad67b0ca19ab157fa58497aed52
SHA512 d01aaa08b9005730d1822455b681179d9d326714b51fdfd00afb0521bd80bb9e06e4bd5d5ad9f6097554f3d2e38d83f629e34220dea799cf8f4d69be25e22305
SSDEEP 48:cVtuTcxBS4lbSC3hrhlNIcWFio79DIfNKrZMWAYs8H4ir/3pG7HEtBr6QxhvPDVO:cOTcbhbhNI5VtVVsFCp4dKBT+0rymxi
TLSH
T1AFA1DBF442B85899EB65FDB0B0E1890234F17DF8FD8F2E4680D89A743DC7354990A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6dc118d29380147cfdce747ea281cdce6a858c2f14925d9ba966013008b11ba2
MD5 9d59e2ce779fc28fcb4a0f624ae815d6
SHA1 5b2bb5b4ee99ededdefbf2e2599f178502d6ad77
SHA512 79649a0f9e995f3dfc7e10ce624616e1269b441bb2ae9dd0c030a6109f2a4903bf8d3ad8b6ae1f3018df50801bc9e61e3ad4021c00f79a090d4190b41b132604
TLSH
T19971A6F54279489DFB69DCB070F181023530B9F9FCAF2E9681D0EA387A92354990B17C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c04d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c04d.TMP
Size 3KB
SHA256 ac0577468fe69c679f45d4f2bed4585faf0fe2f942a1d8b9ef8e6eaa9df9510d
MD5 2068779ce918adbfff427a817a2cb1c5
SHA1 075db75ec1f538a3b3c2af3e1a1c265e94a5461c
SHA512 94001c80477379fe5779b81c9423ae531faa8868be4a69729b4d0bbb4075755f2bf23c3b1e412009c5191fde7810fbd092f38ebd6a3126b7fb342f327ebf10ca
TLSH
T13371B6F54279489DFB69DCB070F181023531B9F9FCAF2E9681D0EA387A92354990B13C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 1516663f75cda487f1c82442cc1a05f8cc4bfe4a31bc96b643a3a9e2b987cbeb
MD5 2f4c15a824b00438e42022561110b642
SHA1 0e61e46be867533554175a69de586c87345428ac
SHA512 f316cb914b84ae9b805e28f55cdbb7459d26aaa7b651af60a519555bbd1339d415375fb16e3e30ec717f2c4f5804554fcbca1945adb9f8a1d9315909f51d2ee1
SSDEEP 192:D//YBe0o53zPqehDD5l0GrtlvfoFEi/Ud8lVrCVXxvrMp+etvlM4ilasp+welcXn:D//YBe0o53zPqehDD5l0GrtlvfoFEi/+
TLSH
T1D832BEBBC2E4895DC91155F9AB14AF1FCE180F549F283C0E84E4BE46ABE2871D16075F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6225e7a042368ef04b03389cf23da934530ac775a9630097e95d49036e23b7d1
MD5 3f2cf73c9dadf8252efa318217cf9211
SHA1 c27627d454dfe842d232ed6820cacf807f9eb9c2
SHA512 11e93f3b81779a5a2ed7cbf1e5dd0b075da2fcd557fa16bc4def01e5505da71df452b3f7575eac31b8cbd4b0ae75187b1c6bb4ac25bf655f257957985ac23f6c
SSDEEP 192:sxZaRWyM/jK1Ml8MkK/fcsE1yXIdpJHgL6+WNGYzcJ76nIgrJ:sxZaoMK/fcsE1xJHfGX89
TLSH
T12542C5166B349977CCCBD209FA557F53D6F90472D2940E48A9FCDA0C04E6AED221B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0505883f1be86f6af67c14e448e119d2732eecd539cda69d27a5d7eb8454c438
MD5 b42e61059c1fee4e609fd7e54f896bca
SHA1 d4befaded3338a1c2c9791da9b3c3d170e7fb4df
SHA512 50a7aba19bd66eba4d0783d68b9e23e9e013a8d2118004f339f56d9528946ed0af312b088929761761ff21636d6b575db2bd818933338d1ddef31418285390ff
SSDEEP 192:sxZaRWyM/jK1Ml8UQgkK/fcs36oXIdpD+hHgz6+WNDe9Gd/YzUs7qnIg5NJ:sxZaoqzK/fcs36zyHvDl/4sZ
TLSH
T15C62C75A6A345977CCDBD20AF9417F53D6F54472D2944E48A9FCDA0C00E6BED220B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5007d3122fcd31fa845b4f1d5cf2c8e76818a387edfdf713c02b7e2e4dfa39c7
MD5 9016d885e1198ceaa6090d14620d30aa
SHA1 c124107ac88bfa976124db3f72c0cdb59b875ebe
SHA512 24889f0b8075240423fd017ef8f75be2c0a8ee4e59fb278e3b3154a98ebec2360bef7a359067fd53a241a02bb1324b4f82ad140d2505350830d029db046a65b2
SSDEEP 192:sxZaRWyM/jK1Ml8MkK/fcs36oXIdp5+hHgz6+WNDe9Gd/YzJT76nIg5NJ:sxZaoMK/fcs36zkHvDl/q8Z
TLSH
T13E52B7166A345977CCDBD20AF6417F53D6F94572D2944E48AAFCDA0C00E6BDD220B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2a1ef9613843f0b13207a854788619ac25d547ec981769593cb6b3f82babf7c6
MD5 a9a5da5c5189cec66d3282c2ef12b111
SHA1 fb450f30086e1b19936d07552dd03050b957d121
SHA512 91a376577744d812aee9eccf394f976238381bc71674eb28647685f73450b7ef3d3c8e44df001bb8154293746d9b52dd5f850f6cbbc4b3d618d923da21634ea5
SSDEEP 768:b6W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjEroITiGYuH:b6W7kf0Wvqidau1jaa5LA3jPjuH
TLSH
T156D2FA3B680CCB7E4F841E5CEC266F966ED801CB67988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2989168da4e9352bafaafabde4e0202693752e9ba629b80669bbb545621dcbb4
MD5 440cec00f6c965836326110633353746
SHA1 48b71a1060132a9770976ca5239166c03e473b25
SHA512 93584d4388de691f762078d242434147cd43098f5f6b6a1efbb302e9641c0cf1f7129c478252e3f7d31059dbaf6ae8a1557b2a1bec105aa1aa5d91c0cd09a115
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTenI1K0k4Py1zIhKM4MIAI/Kj:KIbCKcenWK0kymzuKM4jAgKj
TLSH
T1CC914301317B0681387E28499666957B9F4272533818A9FF3BB810611E7AF564DFFCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595cad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595cad.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e4e3a52648258d26448628c92d2d65bc739a6e0576987a24f5765dcc875c0a6a
MD5 4dfcdda462cbb7f457e0da18cfd347a0
SHA1 f8c527d6cd99af697bcb7f91baf9016ea193faec
SHA512 2760f60ed756237ce609dad5b2533a868571bb5f6323c98744066f838abc8f0cdbe2752425ffbad0cbf9227ea65a1e2f9e1de6e925cf4873298b27804be40fa7
SSDEEP 384:pCZcIhsNob/sbgH1tdKR+29Kv5OObjI9G6w7wX:pwh4SjwlEv529Mu
TLSH
T10C929F35AC385D379EB2A156F4C63A075EF8913BE7C85B88F2EDEB0C05DA56C130A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9fd8cf9e61c585fbee2b5fb322d506ed9ef134b6565f69133584d419b30c53a6
MD5 d75c45f5b48b234235c24eb45cf40182
SHA1 23a46bd6e5e91f161647567a32e00fbbe170bbb0
SHA512 e5e019bcc59e8c488040787154fffece72d9c8f7070f0ceb20f3b7d4d55c5b3d6e8cb7cc59ea1069d98275c3185030d2d33adb42257c3875229b16438ebff250
SSDEEP 384:K4BiFiZcINzsNY8TUNTUlIly/sbgJ1tdKR+29nv5OObjI9G6w7wX:K1FQ1pwgJwjwl1v529Mu
TLSH
T136D229F658E7893AD9AE5743E7BD2D024EFCC067B6849A44B3D89A0CCD561BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 88addc247a2e523248a7f0af7a256251c4cd4ed3710e3a5e56a002a11fe6002b
MD5 f7ddb2ec1a71b7caf26fb41c6a9d6231
SHA1 901c2557b03dfeb500de69292a9ed644ac7b0af6
SHA512 ecf001af4e7ae78ab01fb4eb036d2be5c434cce0a31d509f49ed138dc25d779891f23616b4ef9abebe3b869041fbcc988ab7af6a543bbcdf1c5482ab2c0aa6ae
SSDEEP 384:CCZcIhsNoy/sbgH1tdKR+29Kv5OObjI9G6w7wX:CwhvSjwlEv529Mu
TLSH
T182929E35AC385D379EA2A156F4C63A075EF8913BE7C85F88F2EDEB0C059A56C130A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 11604aa47546935ac7a55cc65aecae9cf27e0d01025633ebfbe4d88748e8e9b0
MD5 8bfa69194390a5660f56792b6a9d7cd4
SHA1 c7fa91e33219d8572ca7640d261f570a21068ff2
SHA512 87e158c1ee73ac0150d5bfd2c2acdcdf3e2d5a3670a163ebaff7af8ba7c3246193e6e420a6ecc33cc0397727f00816156eeb0a5422f5de6a22dc934ced436813
SSDEEP 192:JONJ64BOQmiUytRH5GBPKp/+FdG7BGc+29IWwv6qM8U6:JONJ6eKaHOdKR+29uv5U6
TLSH
T185120A39AC749C3B5EA2B545F48736135EE8412BFBC56B84F6DC6B1C01EF65C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c523e2fd8f306a5cd3a0374fc803f4bfadfbc78a80458aebf4d68aab88941468
MD5 6afb885269b1661f5ab35222fe426e17
SHA1 b4b96361b822e6128559eda6103da7f9b6659490
SHA512 0a996869cecf100e41f9f5ea7f93981867c406d48fd7dc4c105f5ee1449053a5f58dec726c565037c894c9e7402ce266f69500cd49c222518d71ac828a1eb82c
SSDEEP 192:MONG64BAQmiUyu1RW5GBPKp/+FdG7BvaDvACdU6:MONG6eAdDWOdKCvbdU6
TLSH
T1C102EA39AC786C7B9EB2AE45F5863B175FE8112BE6C56B44E6E85B0C019764C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f64e326-a2e7-45a7-a6f3-c0fb37bfcc20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3f64e326-a2e7-45a7-a6f3-c0fb37bfcc20.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a22a945f1fcf920bb7041274743fc7e3d4568011d7679df345baef361de0f17
MD5 d33fad9df300e522071ab7403b1dea51
SHA1 60042b9ab830e982bc0ea2b6f05ac31ab86cebf6
SHA512 1353208668beca97ba70b08f1d3b31017432f518f68996c1580ca8e52248cf0308f5c7fb926a974a588458de1976d68330551e19d477c62260f4297ec900a531
TLSH
T1B441F65CA6F91148B7B7AF5A9FF6A46D487EBC372E07D05E00010D4F4A27A40C961B33
MD5 SHA1 SHA512 TLSH

Submit Download