hxxps://ablinks[.]hello[.]sittercity[.]com/ls/click?upn=u001[.]SeWxE8up7pL-2Ftdt6BYfRIIIZOTkQVTbk6M5MnlEJODigxkJ7VW5wwsXJtfH9WIx3ADAsAP9wPFje5DAhRP3UfDsueWsloNu6ciXzAUVHZA9LrzCZhPZ6r64gBSeFcJkUn9lFeM1Buv2u9XyQ-2FVdsKhNgqE8iheGG6ZTPF0A3zjFFEv8F-2Bzvo41IwqxnmKx79uC6129aavTlSE5LcYy0AfGdcwI-2BmcujnGdJ-2BvSnWHH5KfwfSXmAHJvOQLJS26A

Analysis

user interaction
yes
max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ablinks.hello.sittercity.com/ls/click?upn=u001.SeWxE8up7pL-2Ftdt6BYfRIIIZOTkQVTbk6M5MnlEJODigxkJ7VW5wwsXJtfH9WIx3ADAsAP9wPFje5DAhRP3UfDsueWsloNu6ciXzAUVHZA9LrzCZhPZ6r64gBSeFcJkUn9lFeM1Buv2u9XyQ-2FVdsKhNgqE8iheGG6ZTPF0A3zjFFEv8F-2Bzvo41IwqxnmKx79uC6129aavTlSE5LcYy0AfGdcwI-2BmcujnGdJ-2BvSnWHH5KfwfSXmAHJvOQLJS26A
Sample260730-yef6dsef65

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2904	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299141194085484"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{EB31B34B-E442-4B0C-8060-123FE9E13556}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 1468	4416	msedge.exe	86
PID 4416 wrote to memory of 3568	4416	msedge.exe	87
PID 4416 wrote to memory of 2904	4416	msedge.exe	88
PID 4416 wrote to memory of 3568	4416	msedge.exe	87
PID 4416 wrote to memory of 3568	4416	msedge.exe	87
PID 4416 wrote to memory of 2224	4416	msedge.exe	89
PID 4416 wrote to memory of 2224	4416	msedge.exe	89
PID 4416 wrote to memory of 1196	4416	msedge.exe	90
PID 4416 wrote to memory of 1196	4416	msedge.exe	90
PID 4416 wrote to memory of 1196	4416	msedge.exe	90
PID 4416 wrote to memory of 1312	4416	msedge.exe	91
PID 4416 wrote to memory of 1312	4416	msedge.exe	91
PID 4416 wrote to memory of 1312	4416	msedge.exe	91
PID 4416 wrote to memory of 4536	4416	msedge.exe	94
PID 4416 wrote to memory of 4536	4416	msedge.exe	94
PID 4416 wrote to memory of 4536	4416	msedge.exe	94
PID 4416 wrote to memory of 3496	4416	msedge.exe	93
PID 4416 wrote to memory of 3496	4416	msedge.exe	93
PID 4416 wrote to memory of 3496	4416	msedge.exe	93
PID 4416 wrote to memory of 2440	4416	msedge.exe	98
PID 4416 wrote to memory of 4176	4416	msedge.exe	99
PID 4416 wrote to memory of 2440	4416	msedge.exe	98
PID 4416 wrote to memory of 4176	4416	msedge.exe	99
PID 4416 wrote to memory of 4268	4416	msedge.exe	101
PID 4416 wrote to memory of 4688	4416	msedge.exe	117
PID 4416 wrote to memory of 624	4416	msedge.exe	118
PID 4416 wrote to memory of 892	4416	msedge.exe	119
PID 4416 wrote to memory of 4336	4416	msedge.exe	120
PID 4416 wrote to memory of 4336	4416	msedge.exe	120
PID 4416 wrote to memory of 2884	4416	msedge.exe	121
PID 4416 wrote to memory of 2884	4416	msedge.exe	121
PID 4416 wrote to memory of 5064	4416	msedge.exe	123
PID 4416 wrote to memory of 5064	4416	msedge.exe	123
PID 4416 wrote to memory of 1856	4416	msedge.exe	124
PID 4416 wrote to memory of 1856	4416	msedge.exe	124
PID 4416 wrote to memory of 3264	4416	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ablinks.hello.sittercity.com/ls/click?upn=u001.SeWxE8up7pL-2Ftdt6BYfRIIIZOTkQVTbk6M5MnlEJODigxkJ7VW5wwsXJtfH9WIx3ADAsAP9wPFje5DAhRP3UfDsueWsloNu6ciXzAUVHZA9LrzCZhPZ6r64gBSeFcJkUn9lFeM1Buv2u9XyQ-2FVdsKhNgqE8iheGG6ZTPF0A3zjFFEv8F-2Bzvo41IwqxnmKx79uC6129aavTlSE5LcYy0AfGdcwI-2BmcujnGdJ-2BvSnWHH5KfwfSXmAHJvOQLJS26A
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff90992c188,0x7ff90992c194,0x7ff90992c1a0
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,18088674477457643668,9892790534388778796,262144 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,5739593205965841031,12711102702020186337,524288 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,4417485870659634530,16927034474618435469,524288 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,8737332422667005096,1942408403428997719,2097152 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,7734404212770117555,4559737985911141784,2097152 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,10601141269029682082,119147997105610214,2097152 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,16236560147704392899,10955524440956269277,2097152 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,753999325245964112,11547173526433265386,524288 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,5680063792188008154,14253546684806805100,524288 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,13406523905819503106,3703640183580459658,524288 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,13406523905819503106,3703640183580459658,524288 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,13784325454583952839,2779648208108435794,524288 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,17801809524524650572,17232364556538372607,524288 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,5007427309068788726,13050857668354948481,524288 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,612195768688222648,3951356367638277126,524288 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,15082271732134021547,9740339992254628999,524288 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,6528139332315621519,17324626162723412002,524288 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,11909419234777182147,1931104638470941268,524288 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6248,i,2735564308828465524,17948422031980270168,262144 --field-trial-handle=2272,i,12790879722896856573,15154986159569153382,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 805f480b27c96fadd5283a3f94b801e98266ad5413c2086b86b5c9b655fc26b0
MD5 58e4c8b35d00797a1943b3519afc0efc
SHA1 a03debbc89d311fff4110774cdee08e56e174b67
SHA512 3fe23c40b675a2b0b68bab59a84430f556df39a723ef167fa18726f9a9b7569be65fa1d3c4a57fd722f56e5326540f603d8776c787bfcdb4318592ab29fd67d0
TLSH
T16BE020944DC9C35DD514644741584B4CD5D0360E96CC69CD57028E6571C50847781DF0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 af22f5f29acc8e32608bce9cbeb211fb7cda2464873c58c96f96c95799762aaa
MD5 579ddf5a5a05f06dd2bcb44da5993cae
SHA1 7b8f789b75058e616f94ec4cd92ca8994c003622
SHA512 890f0025f3835ff9cdeb65a8bdf0f72a8d52196c51a60d5de399c39b9107a327746f4f054005e0ddc25299c598d279ac56c634cfa9d72f9d73dd0c3365d45012
TLSH
T1E3E0268488CBC32EEB006447636CA39CD2E4360A96CC6E8E170184A5F242048E7826F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f49857ed20e0fbdce75e2f897ada5af7442888e6664fdc30e8f36b50742a0490
MD5 97d839ddd84f3bbe93c5d561fc73eafb
SHA1 295ca526ec78aea65795a5876ae627b9a6c05159
SHA512 06dbc2490793ed86b3bfa12ae82326ec1ae083c2f20245326c1ac89ebd47aff837f950c97919586ebf1374e69c986c3a0f62735685e3ec5b67edc24191ce333f
TLSH
T1A6714D360087DCADE71D00706CC141F334718DE9F9471E9B91BC2EB41A16B63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589872.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589872.TMP
Size 3KB
SHA256 2fae041b044c875dca2db6c6c0595b2acb1d815259457ffd6a4a22b8f0278e42
MD5 7b64c5f94acd4225a0098667b58eecb0
SHA1 537b3512c14193eeb8e20001787d3e2bab510570
SHA512 4eab3d416c157810a97e4e15da02514ac5672646d4e55b75d4ed6a8337f3e421961acac8cc7dced45297a3a302e5841a5a255fb171c003bcca4f1af52c093d3a
TLSH
T194714C360087DCAEE71D00706CD181F334718DEAFD475E9B91BC2EB41A16B63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b5e3e29fc8c7e44b1e28ceee4764eb2996e7552e63264ec7484bb4b62f30e4d3
MD5 d01f0fec460330ebd02a0ad0871c53f5
SHA1 437e46e54152d5ae15c45c07c493b6a0b2209aa3
SHA512 2d4bbeea2a4371a477c44e73171f338d7c8f54451c8673cfb37254e4f52ff12408944ee948818d8882802546d2ba94665464fde3107fb06fb27ab25fd6fb0f69
TLSH
T179219EF7C3E4866EC90156F0AB24AE2BCE2D051582183D1BC9D4EF5B97E3076E102A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4f7beaa73109c40d2f3dc3851996f4044fef42934103e755e16c0c99a6812a24
MD5 69da29e7908cc315c48a1a37e10ddcf9
SHA1 015354d9485c20a8a74506a0a1cb8666159e97ae
SHA512 3e3433ca3cbaef1b8f74239b952477944d12b6031500f13cfca2550a4d72944e5bca5bb5bf1583c5c0dd60ef4b8f7ebb22787ab389096a717575084ccbaa6ace
SSDEEP 192:sxZXRakJ/fpsHQ+wIdp0MHW6+WNLpP/Yz11tOIgrJ:sxZX/J/fpsHQQ1HbN/Z9
TLSH
T1AA22B8566E28A57B8CCBD219BA15BF13E6F61032A1D51E48E6FCD61C04E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b38da3066434abbf8f1e15ff94f8f0d360443a88fea8de4cf15c935a0051f34e
MD5 4f0989f992868c6519f3159c9877a570
SHA1 fd119feab182f95ffc39a9c847fabd1133c3b359
SHA512 d26d6b9ed9e63bf03f3f5a3f9dd33d7002f35a9789a1430a9e430d36d74697c6198a628e7fdd4edbecbc3a8a2289122c842a2072ed734830ddc14bb5d777d6ee
SSDEEP 192:sxZXRakJ/fpsneQ+wIdp0MHW6+WNLpP/Yz11tOIg5xOJ:sxZX/J/fpseQQ1HbN/Zja
TLSH
T1EF22C7566E38A57B8CCBD21ABA15BF13E6F61032A1951E48A6FCD61C04E76DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 415b112a1ba8dd8d8fad51e67da32daad51eb3b5bbc51d6e01b117e585b948ad
MD5 30fdaef0e990cf6ecc977fa9f10215c0
SHA1 e455d633ea95eb9c6e49095889ba455888a627c4
SHA512 7ea731ccac789bba5f32067c9880e6d7b1a7e3c3f255c33feefd48efb57bac91caeb929bbfce76a7fe4ceadd3f0a542b240568ee8e2051e2f715e55ae66ab839
SSDEEP 192:sxZXRakJ/fpsneK+wIdp0MHW6+WNLpP/YzmUntOIg5xkJ:sxZX/J/fpseKQ1HbN/nNjo
TLSH
T15D32E9566E38997B8CCBD219BA15BF13E6F61032A1951E48E6FCD71C05E76CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f72b4a6ebc92b545fb9b60a85b278630ad0b2f2e2927f89b9859d6d91f141e26
MD5 114c56a1b0bc2fb626111603d9ff85cc
SHA1 374c2b593481c9e72732023437e0038d4bf66fc3
SHA512 12ae7bad2b59ab0bc9dec176042b31e52eec8f6b501bb5a5e4c91b7544774c4ab08bb9b63ed929a4f6f263f1c73c087191f523fb959e233520b26a78423edd57
SSDEEP 768:+0k7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBZroyKYl:+0k7u70WvqiEau1jai5LA3BSwl
TLSH
T1EEC2FA3B744CCB7E4F801E9DAC1A6F973E9802C7A6988D4087FA954C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0d8d0f736f3110ba0481c00da988b32ef5383cba64da37de9e4cf8ef6f74fbe6
MD5 3a408e23db9974e5a51a1bc37657b669
SHA1 41cb5e29269ccd0cc0f731c2651a79b6f8d62d2b
SHA512 03d4ff37387b1bde7b5ab821a6f9c95656dd27e5da11c0f3f9735e89c6ff6a67ef631b2fb4fceee1df09d6364adc4c687d462aa69376e40b631fe1b6dc0b946a
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTvNIZKWcMCeIPK7C8HyRmI/KnK8i:KIbCKcvNSKWc9eYK7CGSmwKnKV
TLSH
T13B91A705313B06803C7E284C9596C92ADE9336663019E56F3BB918724FABE225DFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1bb4e4d1-8778-4888-9769-58daacf4ce1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1bb4e4d1-8778-4888-9769-58daacf4ce1e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 60896da74e703a8061b37ccc3bcd191d10bfc181cc43936b7205a7f8d5be11a0
MD5 ea987428e04feeb378ebcbde196d687b
SHA1 4ab4e755d401b30e2fdf25746274540c99fa9bb1
SHA512 0c4812f1ff995aad3b266e54bf8c45bb79f48a091b12b77b90c3d260c47a868710d5f8fc5edf0b83dc455b319edd3a7b0c4af70f2de5dbf5a73124732e7eeb1b
SSDEEP 384:AiFiZcI4zsNt8TUNTUlIlY4yb0xN7LCRh4OObjI9G6w7jiVU:bFQEYwgNycdw629M6U
TLSH
T175D239F658E7893AD9AE9713A7BD2E025EFCC177B2845A40B3C89A0CCD5617FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 05210b67db851d86ac5878fe7cb2a8318d87910f88174e89c4f02b6a2fe0153e
MD5 d464b3591a4ead2f2afc1e8621df2d09
SHA1 ee5e55d64d5c813dd969f8b9ff62b272456fe2dd
SHA512 08743989968bff7cdbe715639b56f54bc17ac2bccb7e0c8d27e2beced22d41bc5162eff00a9ffec7fcfe910f589a3ed8b361e98523ba3f4b47b5f5bf2c50db3e
SSDEEP 192:MONx64BAQmiUyr1mW5GBPKIOCHruaDojU6:MONx6eAMAW8LL6U6
TLSH
T139020C396C796C7B9EA2AE45F88637175FE4113BF6945F44EAE46B1C00D764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f765ca0ccf95b573976e3469985fe6e4746a8674b0d19ddbb6d736438aaa295d
MD5 4b55a97432bf5325b7537b5a0b6e313f
SHA1 c4a374524ffde978f863af3c99e15ccb93d0a139
SHA512 aab9cf8317df0b366908cebecb7d3ce6036884a03acd02face6ccc446d8a4527da5148e40400ec4dce2b52f017c95f0cd3f63aeae3b4fa779118214d8a64dffb
SSDEEP 384:XZcIhsNTf4yb03N7LCYh4OObjI9G6w7jiVU:fhFyudX629M6U
TLSH
T102929E35AC755D3A9EA6E111F4CA36035FF8827BE3C85F44A6EDFB0D05AB16C4312816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 87fdfdd7647e05cea9ef8cae395adcba3c8ee72d8527753e248a373c1b7cd068
MD5 1d48f4c614b2fe22ea07197b910154b8
SHA1 cb1cd01da618ce9b2576ecd10e9521d518003579
SHA512 696a23fa1e02efffb8ef570cdc57369fbcdd4a3886041d68a0735bc42adb15a78984c4b7faaf2c50a43ed0062c75932b4ff5317945cabe9e3b912028673cc637
SSDEEP 384:ZZcIhsNTY4yb03N7LCYh4OObjI9G6w7jiVU:xhsyudX629M6U
TLSH
T174929E35AC755D3A9EA6E111F4CA36035FF8827BE3C85F04A6EDEB0D05AB16C4303816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 317d7a936dc5c52df242d5db80396fe5bcefa9bc9a5f97d0932e9553fb6f9bd0
MD5 adb3aeb938780c4c921bf1803ad0504b
SHA1 ba2fea9c435a4bb579255b17d8dbecb9e3932690
SHA512 f16d877d779001f9d8562ec2f16938b94f89571f6c61fbdc33c218f00439f8947ab916eb57d9e79ca7f8456a929a13bb25054dbeda6e8bf8cd60a605d4f4dd0d
SSDEEP 192:PON264BgQmiUylmP5GBPKIOCHrWTPNdWwhbqnU6:PON26egRP8LCBh4U6
TLSH
T191121B36ACB9AD6B5E92A551F4C633035EA8427BF784AF40E6DC7B1C01EF65C2306817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 f1635589d63ee8bb5ffdb348c3bd83630fc626e88ce8adeadfb3d138d82af8ae
MD5 032ca50f9855f3633f446d8c9f582c14
SHA1 6bf15cf8c1ad12e21e2d75ca5d58cf82f180857c
SHA512 24f71c54558421e8feeccb14f7734472e5e6ffaa786ce19e3e1e1902148afc40b2a37c4e56a899bc55142e1adcd13a84825650b749a757a879a47aea917a11bb
SSDEEP 192:oLsNToQz18BbzQQmiU1ggi4aGBPKIOCHrWTPNSdNhbqnOOZljYRHKKGn6w81zIeX:usNTo4yb03N7LCYh4OObjI9G6w7je
TLSH
T1F7726D35AC759D664EA2A121F0CA36036FF842BBD7881F44E6DDAB1C05DB29C5316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95d6e176-63d4-4b90-9aca-682aa1d1540c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\95d6e176-63d4-4b90-9aca-682aa1d1540c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a8341cda4ad4ae3228895d97d1b4cbcb7d6d26dba866b4e5e256976069c6ea88
MD5 86a167416f340d1fa3439d970771c759
SHA1 929a1c1a02a88845d20bd38de2c0efc5c8359aa5
SHA512 5d9991323146cfa3665493cb9e82ec678d73aa51caca7d1b1abf3bcfbfdcf04e17e7864f9fee11caa53029a97a92eb9a282951100f27beeb92555efd6ce000bd
TLSH
T1F1410768B6FA1158B3776E5A9BFAA86D447FB9372F06D45E10110E4F0623B40C871733
MD5 SHA1 SHA512 TLSH

Submit Download