7cdc762c7162cf821a90e45fe081aa38c0139499c4223c648973a3cb83299bd3

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wsdashdbasdjwqjkherjhkqawzkjenmasdkxhn.github.html
Size 1KB
Sample260804-ajrwpaaa45
SHA256 7cdc762c7162cf821a90e45fe081aa38c0139499c4223c648973a3cb83299bd3
MD5 8c3e147b26507039ea9b2b54a003a872
SHA1 55d57d1b6637ca334592139bf2f6674f0d02b099
SHA512 2bf3b8c938e990e1041dfeb207ab02cf0df437e0986db8ca3f56f59b54f706ab3370d4aa775c41e2fc5dbb441a0c84e24c8307fb8eed929a98a937f704ca22ad
TLSH
T1A221265F4C7764168ABA20841F7B71445026440F7781C4CCB79FE9489F99A41CCD36EF
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
25	4456	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
22	raw.githubusercontent.com
25	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4456	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302764561376035"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{8B977B67-F473-45BB-AACF-6A7CA45FA7B9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 5924	5556	msedge.exe	88
PID 5556 wrote to memory of 4188	5556	msedge.exe	90
PID 5556 wrote to memory of 4456	5556	msedge.exe	91
PID 5556 wrote to memory of 4188	5556	msedge.exe	90
PID 5556 wrote to memory of 4188	5556	msedge.exe	90
PID 5556 wrote to memory of 1256	5556	msedge.exe	92
PID 5556 wrote to memory of 1256	5556	msedge.exe	92
PID 5556 wrote to memory of 4472	5556	msedge.exe	93
PID 5556 wrote to memory of 4472	5556	msedge.exe	93
PID 5556 wrote to memory of 4472	5556	msedge.exe	93
PID 5556 wrote to memory of 52	5556	msedge.exe	94
PID 5556 wrote to memory of 52	5556	msedge.exe	94
PID 5556 wrote to memory of 52	5556	msedge.exe	94
PID 5556 wrote to memory of 1728	5556	msedge.exe	95
PID 5556 wrote to memory of 1728	5556	msedge.exe	95
PID 5556 wrote to memory of 1728	5556	msedge.exe	95
PID 5556 wrote to memory of 5748	5556	msedge.exe	96
PID 5556 wrote to memory of 5748	5556	msedge.exe	96
PID 5556 wrote to memory of 5748	5556	msedge.exe	96
PID 5556 wrote to memory of 4880	5556	msedge.exe	98
PID 5556 wrote to memory of 4880	5556	msedge.exe	98
PID 5556 wrote to memory of 1828	5556	msedge.exe	99
PID 5556 wrote to memory of 1828	5556	msedge.exe	99
PID 5556 wrote to memory of 1828	5556	msedge.exe	99
PID 5556 wrote to memory of 4760	5556	msedge.exe	100
PID 5556 wrote to memory of 1864	5556	msedge.exe	101
PID 5556 wrote to memory of 1864	5556	msedge.exe	101
PID 5556 wrote to memory of 5044	5556	msedge.exe	102
PID 5556 wrote to memory of 1712	5556	msedge.exe	103
PID 5556 wrote to memory of 5044	5556	msedge.exe	102
PID 5556 wrote to memory of 1712	5556	msedge.exe	103
PID 5556 wrote to memory of 2932	5556	msedge.exe	105
PID 5556 wrote to memory of 2320	5556	msedge.exe	109
PID 5556 wrote to memory of 4804	5556	msedge.exe	110
PID 5556 wrote to memory of 5132	5556	msedge.exe	111
PID 5556 wrote to memory of 1496	5556	msedge.exe	112
PID 5556 wrote to memory of 1496	5556	msedge.exe	112
PID 5556 wrote to memory of 2132	5556	msedge.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\wsdashdbasdjwqjkherjhkqawzkjenmasdkxhn.github.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d0,0x7ffc2642c188,0x7ffc2642c194,0x7ffc2642c1a0
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,17995573650937550443,16629403271551544113,262144 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,2560420275256651463,1117338065931671523,524288 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,4857048154280481955,12961586403002079610,524288 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,13847310764408502361,8894348199247063830,2097152 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,17666945710663755545,13825647532536776804,2097152 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:52
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,1991955517427648237,12823580574998030581,2097152 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,16497954325891004646,1391617106094796570,2097152 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:9
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,432486015228966108,5962773543362019455,524288 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5252,i,14563015005793884555,17019904877817518503,2097152 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,10178122351123218589,14797766791222458289,524288 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,11403143186581212844,14062021790451954810,524288 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,10502875360366791580,13084154082186811429,524288 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,15566069952798175799,9726848948808604104,524288 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11824705384820358920,10135533798950549096,524288 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11824705384820358920,10135533798950549096,524288 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,1287740128368756824,4531583486244614254,524288 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,17752747328562506034,14331688054001156984,524288 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,1017503186050606325,12658178513145997160,524288 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:14
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,15857156772284139966,8075297893942502395,524288 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7132,i,10153509772199191465,13750687821664172113,262144 --field-trial-handle=2200,i,1699010607002600835,11039463443014896873,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cf65993057a4b8eabf3b984ceeb850e629cd7397fa80c569d36a43c273268df0
MD5 5fa73d8b42c5e2ce5de127951c79e058
SHA1 4d30717a5409e302f3a299592f0db59a21b4c466
SHA512 bfa1b5b6ee3f278c7a0c9434f348ffccd493deb9db600f03410026f7183af61e821f99d426b35a8e7386ae0e455cb940234fb8cc0309b80f46f209cbbfae22d0
TLSH
T1F541A956B37395C1DF244F71E0E1D0A97FB58469CE13EEBC5A91A178C882734A0E1A30
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1e57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1e57.TMP
Size 2KB
SHA256 4ecc7e48f004aef7e2f10f7a321229a06771cdad6de421fd0129aeca293d3564
MD5 2e9fa3ec378bc2e69418771c0eb66781
SHA1 2e15c0af57040677c3be83245e8c5b5d15920a43
SHA512 3977229e9a59d578c48f8f497523eb9212bdd568d72c4904191b1fadcd43d6d6bc2e342b4cbe8843470fdf2252976498f09484519d51d3ed08c0b4efadebdae5
TLSH
T131419656B77395C1DF244F72E0E1D0A97FB58469CE03EEAC5A91A278C883734A0E1A30
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2e8d496d3b68b6bba3ff83646a58be0212b88a368f938ede096130c13c411016
MD5 b43b9aecc711c7e838d4f25863897073
SHA1 f3072492128ce329a9c584bb0cd3b279138306ee
SHA512 1211867273302797a43865b14f7bea70fdc5bc18bbb5dc68cfb8b5e847f24287d01d9da0decfebf02fff442868eb935b313606db17cf6fa34e394bb51362619b
TLSH
T10841BDF3C7E4967E8A0156F0AB146E2BCE2D0915432C7C66C9E4AE1BA3F24B1E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e1ce89358bcf23487bcc68a8c841862b6d600b71eb7182ea5baeec098a43774b
MD5 9d16f2c5a740dd07d26f3cbc2a40f013
SHA1 e80fdda9f93ea91ed786ed7f60c8c269ae3cd84e
SHA512 b4d36117348f6f44148da817fdf6a24cc1f664bdc271b40dc0d35d58cbc914511d59514453871c4066135be48a28dcc3073860e92e15d72d3f10be20e9674e0a
SSDEEP 192:sxR1RoOi/fQsWjKCA94/wGzoA8p4G/g6+WNIYD9K6S6G7vIgDdJ:sxR1Fi/fQsWjZ8r7T/5IWSxL
TLSH
T10532F8165928AD3B8CCBE20DBB66BF53D2F9503261D01E18B7FC961C05EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a6db44713b3f5978a0a0140971d92d5a80a2907374948772e619a21e653692b7
MD5 c7e5dc58cec147a8670c08a5beda75bc
SHA1 1857641c477d38a2c89719cc9d1954d321c0ba8d
SHA512 1451fd572d618b299d19ae428b1332962c3c06e36d6ce1b740e7414b3797fbdfc03a58f5aaa05f7597024b82d9080f88ae8d05332ba25e6f0d0c69db93ed44d4
SSDEEP 192:sxReRoOi/fQs4DKCA94/wGzoA8p4G/g6+WNIYD986S6G7vIgIJ:sxReFi/fQs4DZ8r7T/5ISSxs
TLSH
T18232D8165928AD3B4CCBE21DBB65BF53D2F9503261D01E58B7FC961C04EA6DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4aa0123b00fdb562f9cec9fa8fd63d0665ccbfbfe5c887c1cea445e29a2ed6d0
MD5 901035e37f532ed67a356f6183cfcaec
SHA1 e29613e5e6f211fb137d30107aa4d89e14fa755b
SHA512 b1833eac0730f7b65dab58da55c2ea2051ae5174d3f904c831c7edfabaeaf889e01a6019ad607a8183b3d134bd1cea7457eb081b961362225a7e883757dee4ee
SSDEEP 192:sxR1RoOi/fQsWDKCA94/wGzoA8p4G/g6+WNIYD986S6G7vIgDLJ:sxR1Fi/fQsWDZ8r7T/5ISSxh
TLSH
T1ED32E8166A28AD3B4CCBE21DBB65BF53D2F9503261D01E58B6FC961C04EA6DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 c907a370dcda94849e159a32319a23b3f52b4c92b63d034b48c98f0b8e679af0
MD5 9fc8da6aa8b9ca9497a8b0c35050ccab
SHA1 3614aa02d2289bb9bcbb3d65922f619d8910a107
SHA512 352c3454293883d075da94a2aa15224845b94c3f0f6c2239a141c47ab865b68fb5a6de00063296ba897c9a34bda56d0f0447b252012d401af90f25d6f26489f8
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRcsropDM:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0VW
TLSH
T1A0B2EA2F200CCB7E5F800A9DAD196FD77D9802C79B588D5047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 48e571e7289caedffc171ad5a4ff2512fe9219d61d9dbd153b217a12bcfe865c
MD5 7178227d62a460d8f154853b8872c9f7
SHA1 1ef671c5eef8c353f91ef00a18f6e0bb9b67a055
SHA512 2b29d53c2284f80bfe68d79c22f4ee6ee87565f5bcaf0ab43277f861087420fc76fd2eb5582c542a79a7aeab5f1713b8cc9c819167d4b1edb395396111180891
SSDEEP 384:rZcIW38NhypVWAMWZlf8hyEGGzUCt38y2rEoajo4cdR8eHhVODjYPNDUMRKeRs9w:zW3fli0ct3IrEnjN3Gac1FRojKgqmUHn
TLSH
T17CF2C0346C65AEB38CFAE7C6B5437B03AFF04213D1C40AA496DD760D0697AAC530B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1ca90339544f135f0e55bc78b397363c8c1d5883672b6d4031a9ba40bdb8bcd8
MD5 1e895bfed2a9552eaecdec99904ca446
SHA1 fac724d7c184ba277b03712a79a298c909cf39a0
SHA512 561ab55ef3b752b673e1f75568a1396eed1ac0a614abbae9a74b435719feb6e6e25279b7129b5c3530cfd9af4998ed84d1060d39fb67f59ed0eade939b739f64
SSDEEP 384:ZZcIW38NhrpVxAMWZlf8hyEGGzUCt38y2rEoajo4cdR8eHhVODjYPNDUMRKeRs9w:xW3Dli0ct3IrEnjN3Gac1FRojKgqmUHn
TLSH
T1A8F2C0345D65AEB38CFAE2C6B5437B03AFF04213D1C40AA496DD760D0697ADC530B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 955ee3d9996c1df1860630c222c5fc47752de8a1f21f316e34bef989073fdc65
MD5 1a027965cde9b424f72157924be56738
SHA1 2445a200af2e71750713ef7198c7538b9bfa890f
SHA512 542be0ead80902c9907178e282e798aa1473e9e305fd82dc07ca2ac84f5a7e4d9717570742bcd0c81e27727ecf3893fca97ef776e5679473e79ff7c7a762bb44
SSDEEP 768:rrv+4UNbdS3Ymi0lrEnjN3Gac1Z8eVH1SCz:rbsbg3vlQnjMajEH1V
TLSH
T19003CF3269A89E738CEBE38571877A037EF4525385C40BA0CADD2B0D46DB5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5c73264f4b212f795a56b0bfb61bea21944507b66aac6226928f2de3e551d29e
MD5 19f083e378a3deb525f6735c8ff2cb52
SHA1 25f5d3b45abc1142b6c65392b1af43bdbec4276c
SHA512 ade72d79d8f88af7d6a8960789c0a9376670090a77eebf15311b8ed64a64e54d007f9022b79b66c05f65211ab1ea5da3a2f24ae2d8589811332eaaab2ee4155b
SSDEEP 384:QqZcI738NhypVWAMWZlf8hyEGGzUCt3oy2rEoajo4cdR8eHhVODjYPNDUMRKeRs+:t73fli0ct34rEnjN3Gac1FRojKgqmUHn
TLSH
T1CBF2C0346D65AEB38CFAE7C6B5437B03AFF04213D2C40AA496DD760D0697A9C530B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4ba2dc0-4dbe-4b25-93ec-bc3141c2c31c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b4ba2dc0-4dbe-4b25-93ec-bc3141c2c31c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

bwpaaz.dll

Path C:\Users\Admin\Downloads\bwpaaz.dll
Size 498KB
SHA256 8a8caf0cfb02a65bb02c7df5f2a3d5d88db04de0b364b0c87a540fbac1ff6b0b
MD5 e6a1fb79e061a066c7611fe6635a3ebd
SHA1 c790bb69af520b4b111195ff61655a3250152cf8
SHA512 decacffebbc6ee4c369be4452b56277e6862999818d6d95de4f1334de5d82fe20c22d7bcb1a3545b3300d761f92c61f09b24ad22edc7439d7b1f3f2121175f75
SSDEEP 12288:hFLlmthPKZL0bgmfUjSH8QlnwV8k0nN2Th1:hFLwthSZL0VfUdQlnKnf
TLSH
T113B49D15F3A900B9D167D53CD657AF0BE63138044B11AACB73D1EC682FE27E05ABEA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download