hxxps://app[.]there[.]do/org/org_3HPNCY3YFW9XwtFKOB8z46Yto0s/r/Frederics-first-doc-d360e234-8e00-412f-9cc1-c55f33fc2c3a?utm_source=website&utm_medium=clipboard&utm_content=copy

Analysis

user interaction
yes
max time kernel
65s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://app.there.do/org/org_3HPNCY3YFW9XwtFKOB8z46Yto0s/r/Frederics-first-doc-d360e234-8e00-412f-9cc1-c55f33fc2c3a?utm_source=website&utm_medium=clipboard&utm_content=copy
Sample260804-ll9p3agh78

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3500	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303099180233855"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{E91265F8-2827-4FD7-88F9-0D72F69BEFC1}	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1272	1852	msedge.exe	86
PID 1852 wrote to memory of 3500	1852	msedge.exe	87
PID 1852 wrote to memory of 312	1852	msedge.exe	88
PID 1852 wrote to memory of 312	1852	msedge.exe	88
PID 1852 wrote to memory of 312	1852	msedge.exe	88
PID 1852 wrote to memory of 1360	1852	msedge.exe	89
PID 1852 wrote to memory of 1360	1852	msedge.exe	89
PID 1852 wrote to memory of 3272	1852	msedge.exe	91
PID 1852 wrote to memory of 3272	1852	msedge.exe	91
PID 1852 wrote to memory of 3272	1852	msedge.exe	91
PID 1852 wrote to memory of 4960	1852	msedge.exe	92
PID 1852 wrote to memory of 4960	1852	msedge.exe	92
PID 1852 wrote to memory of 4960	1852	msedge.exe	92
PID 1852 wrote to memory of 2096	1852	msedge.exe	93
PID 1852 wrote to memory of 2096	1852	msedge.exe	93
PID 1852 wrote to memory of 2096	1852	msedge.exe	93
PID 1852 wrote to memory of 2912	1852	msedge.exe	94
PID 1852 wrote to memory of 2912	1852	msedge.exe	94
PID 1852 wrote to memory of 2912	1852	msedge.exe	94
PID 1852 wrote to memory of 2304	1852	msedge.exe	98
PID 1852 wrote to memory of 2304	1852	msedge.exe	98
PID 1852 wrote to memory of 5092	1852	msedge.exe	99
PID 1852 wrote to memory of 5092	1852	msedge.exe	99
PID 1852 wrote to memory of 1912	1852	msedge.exe	101
PID 1852 wrote to memory of 1804	1852	msedge.exe	103
PID 1852 wrote to memory of 1804	1852	msedge.exe	103
PID 1852 wrote to memory of 1804	1852	msedge.exe	103
PID 1852 wrote to memory of 1696	1852	msedge.exe	104
PID 1852 wrote to memory of 1696	1852	msedge.exe	104
PID 1852 wrote to memory of 1696	1852	msedge.exe	104
PID 1852 wrote to memory of 696	1852	msedge.exe	105
PID 1852 wrote to memory of 696	1852	msedge.exe	105
PID 1852 wrote to memory of 696	1852	msedge.exe	105
PID 1852 wrote to memory of 3364	1852	msedge.exe	108
PID 1852 wrote to memory of 2436	1852	msedge.exe	109
PID 1852 wrote to memory of 3212	1852	msedge.exe	110
PID 1852 wrote to memory of 4648	1852	msedge.exe	118
PID 1852 wrote to memory of 4648	1852	msedge.exe	118
PID 1852 wrote to memory of 1804	1852	msedge.exe	119
PID 1852 wrote to memory of 1804	1852	msedge.exe	119
PID 1852 wrote to memory of 1804	1852	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://app.there.do/org/org_3HPNCY3YFW9XwtFKOB8z46Yto0s/r/Frederics-first-doc-d360e234-8e00-412f-9cc1-c55f33fc2c3a?utm_source=website&utm_medium=clipboard&utm_content=copy
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffb20eec188,0x7ffb20eec194,0x7ffb20eec1a0
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,15806796810590008663,6902964192737945049,524288 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1788,i,10845398606925872530,1932726779285316673,262144 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,2645833920761385997,10326802072665081199,524288 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,14677175023077933387,1409908180843864931,2097152 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,755471183334528781,9111864917846366388,2097152 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,5326906866981065755,4849260820171920528,2097152 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,16673613180554545566,15413507903858340378,2097152 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,17050431102511387889,9419645326736165355,524288 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,13204345190848325210,17366751974472430381,524288 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,11951310828014276736,6498624562543685934,524288 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,11951310828014276736,6498624562543685934,524288 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5852,i,14891257292569077227,13995909144363707666,2097152 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4532,i,2512989536923328817,12241086436596665030,2097152 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4520,i,2789551152352432707,3735374103939020668,2097152 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,12496143428109551961,10466484735372719244,524288 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,6566952809002347969,4799575008463688983,524288 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,12344986090716730544,16035489133188257942,524288 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,17083073643656209662,4497034088380680045,524288 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6276,i,10428034159853666329,12988765058662440135,2097152 --field-trial-handle=2304,i,18442197891317770263,10360549627213960024,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 17d500b4417e92837c05a8187f43f060e09191612c25892f2c54e786bd254c36
MD5 ca52a84f03e904e79c2a5651b273e5fe
SHA1 61ddeaf1850d81986389db97ff9470b67eb8cb1d
SHA512 d1f489b74d4da21280e354fdfd91d6569edfcb1abc7f4f6740756bbe744f02bd51136d5ea47c7a6a1842683dc3eba0d2608d4d46e5eb8ffb5035ffeb98f9c788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1B9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce6612fa5fcb5a512497cb33ab0a3f706834ad222b5696f08863894b1e22f287
MD5 b61a574baf562cd71b636a2b715fa711
SHA1 1fe7a2a795a9ea179937e2326d82f7d0c1f76cbb
SHA512 57b5f9e658e9938a2274a5d040d251b026a2fcdbd7196c08e91c9c8804e840797cfa3f824cd2d748b67ff79abda6aef8ac5f973bef648bd0029490924828ef28
TLSH
T141D02370B83193D0D219003C0450B5011218877236674362E140880CAD3200083C69D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 641903441876849bbb01e4b4a9543d0694d71e3bf1773a868389fb1ee2627511
MD5 1cd74c14a7bb83ed4524eee0d2dc5e52
SHA1 91b72329687d65c7f9237dfa5952447a80a41082
SHA512 5d18e32f305730be04c941afbb18644105b5d2aef3236662d720d9cb885d1722d52d0b49801732193bae3f8d4b610fef38badd28f637502d00331524c54355a5
SSDEEP 48:Vcv88jo3cXe1RMDSdzg32dwFoWqg0qYXwsbNN03iBcsuFbuhkG84S:VUe1oSdxdngGXwCN4ccsvkG84S
TLSH
T12BB1D93781A261C0E750233A90D38626B5718EDAFF7B1FAE2B4C15F32B667520D45D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58bfff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bfff.TMP
Size 3KB
SHA256 7b3b2f3efeb543ac36b45b9b3f05a0c1d24990b0a2032519acb5c62df285c5e7
MD5 589a0124fcbbf3ce2702fc2cf104a04f
SHA1 25982939bd6a7507c99d0fc43ab37ce598781671
SHA512 caad1c83f61890e2b4e2cca28f2a597b7e9988d7037b2f990343b462989d6aaaa7c5bdc7fc3683b4721265d61cb57e2eed51dc8f7ed28a047deb75ba6dfd6680
TLSH
T1648161370282A6C0D3A4273990E68224367082EBFF6F5F7D3B9459F12B767250E19DD8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7817980e1be283af4cd96dd047b4311cb2b73476055ea6d0618a1c59993db14b
MD5 e1d65fecdd911aedebaaac6df3a032c5
SHA1 8bb641a3012d2c156f5296c77aae51d79334076a
SHA512 37b7318ea15587572c32c43be19ce54f8b09acc1283c9e41333df06bf66ffbe9d364654c9a43dfd8552d436c40067069f4a8b98c919854ed1a35f0f062e34d33
SSDEEP 192:sxZWRnvyM/jK1Ml8Mkr/fzXs7ztmIdpeleHW6+WNa9D/YC9rIQ+lIgrJ:sxZWtLMr/fbsXtHpHbY/yQ89
TLSH
T12752E9116A349977CCCBD20DBA51BF53D6FA157292900E58A9FCDA1C04E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 06eb80b1dcac612d8218f8ca76b50bf5b3cdd73033b28cc458d9a5989ddc8f84
MD5 bd7276a4e99100bf0086db8c003e581b
SHA1 eda7f1b85549dcb92048f9260499a99802504a12
SHA512 e737535605194915aae15f4f7ce0df6e977f7f80cb3a2173714c02c915015320fe753d54adf80ec5b2a7421de4b4c35dd0acefed40303fcd8353a24c7926cb43
SSDEEP 768:kV8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVDroJ:kV8bqn+WvSCt6u1jaCZLbWVwJ
TLSH
T1A1D20A3B280CCB7E4F845E5DEC26AF962DD801CB6B988D4447FA884C03C72EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c0d8da0cf747de8b6c88425df4808d1704193403134dd6dc6924dbe121b218c4
MD5 426f107c6870641d98ccf9cbda7d2346
SHA1 26f52dc9dea84147bdd71bdaebee1b4790133c55
SHA512 84fc199de6097b59827721b65f0aa8d516b62a7fbb01c1c6a8d26232bacc08dd470a5dab41559df9d3b78cb08d60f4c3dd241502d04ba9ab67cf507265bc3947
SSDEEP 48:KoXIpK0g0bypQIHKpOXwI/K92c7yfa/Q0CkQzPg9CI4szKpqBOzVqj+lYF:KoX6K0gCKQoKpOXwgK92SWXOKo4k
TLSH
T1BEB1E306303F124638BE2528A3B6963BCD41B3573915ACBF3B7920668D66E514CBDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

d8b00125-51ba-42de-a3f4-8048cf95074e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d8b00125-51ba-42de-a3f4-8048cf95074e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1434c67b19a9a20d96134cd6dcab7d73be94f422ed0407ca8cd78dff6feedc03
MD5 11eaa72d9d0e58301cc1dda09d3e5f72
SHA1 0ade3abc5b7175d000d32e557861ff86b3a01b88
SHA512 7267a866ec970f8a20e151b64429b2e85c695af07bf8e70894abc16eecf0314c66dc9e786e21a73bfed7ca9e63af2cc76e4fb4f2e02fdd5e557b37825154bf86
SSDEEP 192:uxLsN6UXrQdmqwbiEWQmiU1Qmr4Ea+j2+FdCrtmEpe4GQama7qQ61Fs:isN6UXrcPf90Ea+ld8LaHes
TLSH
T163423A3268785D775EA2B649F84736039FF490678ACD2F94E6DD5F0C00DB69C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ecf628e349fc26d121688486888db972c4c49f367709b4d11de8f6a7d6242f19
MD5 2381a1590a7e14036c4dabad0f5002e1
SHA1 ab9a1e8421eb3a25f92745c4ee2c2ab3772ff188
SHA512 66277c13151c6d42418f450d9a0791d225c14e22f68076a842133c2fb27e33bdef640d7e098e2bb73e38b436f1261f64f7555d2cf590413441868de701e6bec8
SSDEEP 192:vON3p6Db6QmiUyqaHBa+j2+FdCrtm5RgarJWU6:vON56u+HBa+ld85a9WU6
TLSH
T1EC02EA3568786CBB9EB2AE49F4873B179FD4207BD9962B84DAD81F0C00D765C1307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 21e0e3214c617c3486c0e67746a9e63ab2673c97edf4a0afbd01ea805fbdaabd
MD5 f36418890bd8667da897e68a4369f307
SHA1 bb470dac764aab427e587bf75f7e1fd927fa39fe
SHA512 f97a1fc53762a4969dac47df8fa1975156fba06c5ce589bc0df651143e8186f90351cea3512a0309869342c0556ae95aff20c687ef3d1afa976a9bc3667ef4f6
SSDEEP 192:uMm+xasuheOwQxMGsN6UaQdmqwbiEWQmiU1Pml8BEa+j2+FdCrtmEpe4GQama7qs:2ZcIhsN6UacPfcl2Ea+ld8LaHew
TLSH
T158726C326C385D7B9DE2B549F84636134FF8906796CD2F94E6EDAF0C00D79A8130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ee7479393950c57a635f3c749de3af7614142dd609936d046b5c423a623b1eba
MD5 21bca0e39471a03d0a043b54b538b07d
SHA1 63ab6fc7d706b9186ffd02601d27249870e1f7b5
SHA512 defc316ecdb6cd66620e0ff0c4a9827bbeb71b0f94183dad9bf05b0e0fc02db1b70984d0dad3c112ecdcc8a7252d6f510c840c01d91c9a652d86b514786be9bc
SSDEEP 192:8ONo6DbvQmiUynaUBa+j2+FdCrtmEpe4G+Nza7qQU6:8ONo65xUBa+ld83aHU6
TLSH
T1CE123C3268785C7B4EE2B559F48736135EE55167DA8E3F94E5DC2F0C00EB69C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 08101afabd90ca8dd91c086301e0ae1583b9ddec040e7bd3b8eb9ddb9a36043d
MD5 be1a8d17280142cdee25d4c2a2c8fb99
SHA1 81892afbb378c9292333adf40def02e7b210cab7
SHA512 f829ce00b93fa796012f24a9f4b51536d0c85a72e5a9cd8ef01d7c27c39dabffca43d66ee1f2c937ebe03fa039a905f93663f2d015978e224aeb146e496b077a
SSDEEP 192:uxm+xasuheOwQxMGsN6UfQdmqwbiEWQmiU1Pml8BEa+j2+FdCrtmEpe4GQama7qs:XZcIhsN6UfcPfcl2Ea+ld8LaHew
TLSH
T1C8726C326C385D7B5DE2B549F84636134FF8907396CD2A94E6EDAF1C00D79A8130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe5bef94-f300-462f-88ec-dcfffae8ef97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fe5bef94-f300-462f-88ec-dcfffae8ef97.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ea90e36f566d78f4b55c39b9d08d4952947c5ab1e8d2ea98a8859844c6e60572
MD5 c5f59a8ae0beb3df949619c9d0821271
SHA1 dab65062e894af1d8ca86e460f38b0ba5fefb0db
SHA512 ee2e127194c6fb9f2e5c1b7c12cb2d37ca7672a12bc3b048dd05f669e4783079cb56719b9a0c9c3f633b3ac45df18529da1ea063de10e41e4830562df2a08b79
TLSH
T106410B58A7EA1148B3776E5AAFF7A86E843F7D272E0AC55D10110D4E0763A40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads