df6d7c5aebfe125480d915242c7c91afecc9e580835d033f7e351568d9b0459d

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MjcwLUZISy0zMTYAAAGjUxIzbkVyeJwFalWmH3H9T9Z1LhdlrjncU1jmoT8avfFPn_44HZvXCJNgLulZiif4AAheMMU=.html
Size 556B
Sample260802-agjsasah38
SHA256 df6d7c5aebfe125480d915242c7c91afecc9e580835d033f7e351568d9b0459d
MD5 69159adccd2d6bf76242689032a41ce2
SHA1 f71bb056c42faf1abebaeef88c992e06902c3b84
SHA512 38e18623738bb505a9403cbe932e2c286ffa0c3e58481972c25e8b67a6a00f88a0192dfc3e8d3e25ae26dc420d7e99ceeefe346ebe279206cefff3eed6869217
TLSH
T12DF0E1937CC0D8173BB240046A85F30C94371470005CFA4CE6F291151C86B9A85BB7DA
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2852	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301036906352299"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{DD9AF94B-0EBB-49F6-AD2B-5E9EA8199EEB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5740	msedge.exe
5740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 4672	3428	msedge.exe	89
PID 3428 wrote to memory of 2852	3428	msedge.exe	90
PID 3428 wrote to memory of 5644	3428	msedge.exe	91
PID 3428 wrote to memory of 5644	3428	msedge.exe	91
PID 3428 wrote to memory of 5644	3428	msedge.exe	91
PID 3428 wrote to memory of 3968	3428	msedge.exe	92
PID 3428 wrote to memory of 3968	3428	msedge.exe	92
PID 3428 wrote to memory of 3464	3428	msedge.exe	93
PID 3428 wrote to memory of 3464	3428	msedge.exe	93
PID 3428 wrote to memory of 3464	3428	msedge.exe	93
PID 3428 wrote to memory of 4636	3428	msedge.exe	94
PID 3428 wrote to memory of 4636	3428	msedge.exe	94
PID 3428 wrote to memory of 4636	3428	msedge.exe	94
PID 3428 wrote to memory of 1264	3428	msedge.exe	96
PID 3428 wrote to memory of 1264	3428	msedge.exe	96
PID 3428 wrote to memory of 1264	3428	msedge.exe	96
PID 3428 wrote to memory of 108	3428	msedge.exe	97
PID 3428 wrote to memory of 108	3428	msedge.exe	97
PID 3428 wrote to memory of 108	3428	msedge.exe	97
PID 3428 wrote to memory of 2400	3428	msedge.exe	98
PID 3428 wrote to memory of 2400	3428	msedge.exe	98
PID 3428 wrote to memory of 2400	3428	msedge.exe	98
PID 3428 wrote to memory of 5008	3428	msedge.exe	99
PID 3428 wrote to memory of 5008	3428	msedge.exe	99
PID 3428 wrote to memory of 4640	3428	msedge.exe	100
PID 3428 wrote to memory of 4640	3428	msedge.exe	100
PID 3428 wrote to memory of 4640	3428	msedge.exe	100
PID 3428 wrote to memory of 2404	3428	msedge.exe	101
PID 3428 wrote to memory of 4764	3428	msedge.exe	103
PID 3428 wrote to memory of 4764	3428	msedge.exe	103
PID 3428 wrote to memory of 3836	3428	msedge.exe	104
PID 3428 wrote to memory of 3836	3428	msedge.exe	104
PID 3428 wrote to memory of 612	3428	msedge.exe	106
PID 3428 wrote to memory of 2516	3428	msedge.exe	110
PID 3428 wrote to memory of 4416	3428	msedge.exe	111
PID 3428 wrote to memory of 5716	3428	msedge.exe	112
PID 3428 wrote to memory of 4516	3428	msedge.exe	113
PID 3428 wrote to memory of 4516	3428	msedge.exe	113
PID 3428 wrote to memory of 5740	3428	msedge.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\MjcwLUZISy0zMTYAAAGjUxIzbkVyeJwFalWmH3H9T9Z1LhdlrjncU1jmoT8avfFPn_44HZvXCJNgLulZiif4AAheMMU=.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa87c2c188,0x7ffa87c2c194,0x7ffa87c2c1a0
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,17497972790925576276,6847358093685545429,524288 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,7594595615022740108,8947247269088372741,262144 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,2927306938151567746,17170824586296206555,524288 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,14822263375642487643,12333189690624710391,2097152 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,7326924999075750408,70799953504017806,2097152 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,1326928766330125806,11958162381716240131,2097152 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,15584180073546892655,14560365347550653683,2097152 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
  2⤵
  PID:108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5392,i,1592433041522189217,6030635858405411462,2097152 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,317126580854854508,15799294738863014069,524288 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5364,i,8703783967058056599,473507723384272824,2097152 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,474071150219858328,14367450816914297811,524288 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,13561790622115305648,1108752492799747387,524288 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,11751360543219841168,2419306117728281851,524288 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,8503757731421170685,11570936278294771107,524288 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:14
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,8503757731421170685,11570936278294771107,524288 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:14
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,18099140445048235767,5155696279079113064,524288 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,15050156066390323562,5036832730114384489,524288 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,2339915789477125051,6756739164594700840,524288 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,1559953910279468767,13836562679784551710,524288 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=804,i,6640209410444986594,5048163386431829633,262144 --field-trial-handle=2448,i,11225215763344207763,3974546576086201456,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d84ce2e6a1f9b5ac241c1161a33a483919f197186ec8307d905f06771d802968
MD5 01862dd41fc23713de2f7fbb7d46e332
SHA1 14ee0546b15b8c9e6b32bd76f50f6069743ef59b
SHA512 3afc08ee63f12a1d887128a4f202b12beea4d7d2a0155ea44fee335ad03cd4d9e73ecf9db89bfd8a3272fdebfc006ac75badcf4efe1a0cce4a8f696439670cef
TLSH
T1AB61C86403222AE1E3E8487671E577443AFC9C650567EE1C836CFD786C12F9DE5E902B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598b1f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598b1f.TMP
Size 3KB
SHA256 dee5e997fefab15b629e7a3a47cb746d4e8e16b59956dcdca9356e3a3957df56
MD5 e8b1b6cb5269a3d9c9750ff7362905d8
SHA1 4cb5587d09ddbe9871af2a3868586669547d5f5d
SHA512 c5412ca65c9b42ae899212f70f849ab4f212b77a10589576b9693744e9faeb5ad1ac5622bcba27ae9179ff576ff4c158af9853eb64cfce51d1a15c26942fe194
TLSH
T1C661C96403222AE0E3E8487671E577043AFC9C650567EE0C436CFD786C12F9CE5E902B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8e73c5dbdf0618380ca5c56a9c99d20c5587ffd4790709c1b65c97328b061129
MD5 71e8a9474aa12cbf3442bcffa149726b
SHA1 4025fe77914f66d6ec222bfaa22268d7fa42865a
SHA512 3146fb9654d02d1713b8dc733dee23447c1a70d45c87d41a4991a787544ee88d4c30514cb59d7e527b0ff709251d7abf9b23c1f6ffeec77056d39fa0ada35d0c
TLSH
T11441DDF7C3E4966E890186F0AA147E1BCE2D0915832C7C6AC9E4AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 516432a39ad01536731e8eff91c285019a2bf3bb301d732996aacf59cca11a51
MD5 856bb052b0e2a630f93c5f381b01ad26
SHA1 4857966fef23e47bc4ee14ad31d3329211a5df1e
SHA512 d1dfabaa398d73a500225cff5bfe0f91aac1bfd7434ef53615c12c746c4f914ca9dd5e5a6bedaea23a76f0f3c6740b661dc70b9482d212433e60d9f94202a8d8
SSDEEP 192:sxRwRQOV/fpso6cprQ5tzoA8p4J/g6+WNIYn83hGGrIgDEJ:sxRwlV/fpsoxdg/5ITRVU
TLSH
T10E32A6566A28A93B8CCBE21DFB55BF53D6F9503261D02E58B6FC9A0C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3f1bcaa0153d3628aab4d8ad8aa3e684e0c22e5f85515613356d8113d800f870
MD5 a878db03648a56e5706f8b94a79d2496
SHA1 59c8759235fadd2062bd386b9b747d60833fcd2b
SHA512 c835f3c1f3dc3b0494bcaba857c077933cd550e850dbdb16f19e79f81c89711b3ee2a9effacab71528a52a643cc4ae932d5db974e2a0effafbb9b5bc44733354
SSDEEP 192:sxRwRQOV/fpso6NprQ5tzoA8p4J/g6+WNIYn8XhGGrIgD2J:sxRwlV/fpsocdg/5ITxVu
TLSH
T1B432A6566A28A93B8CCBE21DFB55BF53E6F9503261D01E58A7FC9A0C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4161b5e0c462d4deb56e6ba1a2b6629ab14d5f38a5d87eff3c40548368892916
MD5 00cdfa3ff1396e402d0915cea0203dbb
SHA1 5d05a2b487b934c7999b2d1a23d2a00a16df7c4e
SHA512 b83f0c228511981eb9489a4de9eaf2abb8aa681131e4e9b40f2aca78ce78ea1c4a1a16c2bd0584803221d9de0ed10e2cd5512b6efd5dfdeb5df037aa11f0972e
SSDEEP 192:sxRzRQOV/fps26cprQ5tzoA8p4J/g6+WNIYn83hGGrIgIJ:sxRzlV/fps2xdg/5ITRVs
TLSH
T17A32A7166A28A93B8CCBE21DFB55BF53D6F9503261D02E58B6FC9A0C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 eb404e8ef032bbbd688f62400795735b3474a3056f0059fc1dab29356159fc16
MD5 87394cd7e238b4251a0f03e05870e679
SHA1 25a0a69b701c4db4b6c9b9d1ce195d8ad11fdcaa
SHA512 0888e076549045160cd6fffb1635dffabbea51f494b13297c266281ecc29242bf2a3854bbb351b45302bd1fa9b5e36a2c10a4a536ed300dacc42f9ee9110ec7e
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPcrohMN:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0V7
TLSH
T1A6B2EC3B604DCB7E4F800AADEC19AFDB7D9802C79A988D4447FE990C03C77EA51194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a252d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a252d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 204bba8976bf109ca2b3b8295cf1a73138c31de8c0878a51fd50b756832a8197
MD5 d9845bcee0a1fa7c851bf812b6111034
SHA1 3adb64e95badd5d8bab7745f083f47da63b6abab
SHA512 00668ed520b4fb940e3d08f56da85ff5ca6fd9a1b6246fe3f32490eabe86aacb6873ca1053452cfb6ca8bb0603cfda614f50c97105090eb64a48f60bad6db8b8
SSDEEP 768:4rv+4UNbdz3QoDZIO0WzSNzc4ReyIsPC2ewBKZOsF:4bsbp3b+tc44bsK2evZdF
TLSH
T1B913BE32A8289D77DCE2A685F50B75437EF4516781C81AA4DADE2F1C058B2ED131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 453a4681717be0d6de134782faa5d3cba3ade0bfdb685b53fdc4f5a1015d0be0
MD5 8f81b5fb99c7bf04ad084e3b4f30a7dd
SHA1 e83b4f1c9ec899fca4c9fd25dbb35fdc4f8674e9
SHA512 6cae53303b8a40bd7b1cc1877a38f27ee549b54024ccafe6120ba9c449a441df934d585d497dec1519844568890178e93a4e68a8707bc0dc8b675b45db9bcd1c
SSDEEP 768:5FQt3gwgjloDZIO0WzINzc4ReyIsPC2ewBKZOsR:4t3m4Etc44bsK2evZdR
TLSH
T1CD03AF72AC64D97BECF5AB85F90A3243ADF14167C1D869A4E6DE6E1C05472EC034BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 07e069e2c185c38506c8f6aa44ebdb306c6270bd11173d15bf73231f21c162f7
MD5 1af49d4622da094286d63e5b25b06f33
SHA1 cc75939235ffa417b9d347fc9d7745a139df76b1
SHA512 0dc9291f2422853d8cea17278f67f29aa4fc2586cfe56f04e08f707237709ded010eef31a9553db448b34415567e304d422c30af2a604f925bb8d238d23b54fe
SSDEEP 768:lM3sloDZIO0Wz0Nzc4ReyIsPC2ewBKZOsR:lM3s4otc44bsK2evZdR
TLSH
T1EBF2CF71EC289C77ECE5A685F9063243BDF44167D1D82EA896EE6B1C04472ED131B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5b75896ea434177d635fa1e5880c186817acb1c445aa8ca0fc82c15982d2a432
MD5 683a8c9b82c16eb5c97f03f7cdeb8f6a
SHA1 e71865d6eebf2216222ab41590ab10e65a8aed2b
SHA512 b2512325c9d19f8aa9ed75f3bb070cfd655b962e978e45e20aff117ebbde54b0d848efdbd937f7bd1b9f0696b596bde89026832170fd2c2134da5415dfe722e5
SSDEEP 768:6rv+4UNbds3sUDZIO0WuNzc4ReyIsXyeVH1S5D:6bsbS3futc44bsCEH1Y
TLSH
T15703CF32A8788A77ECF66685B54B76533EF8912B82D81E94C5DE6F0C064B1DD130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08aca3b8-081b-4130-a2c8-05df8338b372.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\08aca3b8-081b-4130-a2c8-05df8338b372.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download