hxxps://firebasestorage[.]googleapis[.]com/v0/b/zmbspnwoneto[.]appspot[.]com/o/alldman-ooommnne[.]html?alt=media&token=7c91e5e1-76da-4b05-aff2-5b50e494457e

Analysis

user interaction
yes
max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://firebasestorage.googleapis.com/v0/b/zmbspnwoneto.appspot.com/o/alldman-ooommnne.html?alt=media&token=7c91e5e1-76da-4b05-aff2-5b50e494457e
Sample260804-rcljrsscqc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303257953169693"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{4A7499AB-BA02-4F43-9362-CBB6746159F1}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{47228D6B-DF8D-462B-ADCE-E81F2137DDB0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2288	1448	msedge.exe	83
PID 1448 wrote to memory of 440	1448	msedge.exe	84
PID 1448 wrote to memory of 2384	1448	msedge.exe	85
PID 1448 wrote to memory of 2384	1448	msedge.exe	85
PID 1448 wrote to memory of 2384	1448	msedge.exe	85
PID 1448 wrote to memory of 896	1448	msedge.exe	86
PID 1448 wrote to memory of 896	1448	msedge.exe	86
PID 1448 wrote to memory of 3116	1448	msedge.exe	88
PID 1448 wrote to memory of 3504	1448	msedge.exe	89
PID 1448 wrote to memory of 3116	1448	msedge.exe	88
PID 1448 wrote to memory of 3116	1448	msedge.exe	88
PID 1448 wrote to memory of 3504	1448	msedge.exe	89
PID 1448 wrote to memory of 3504	1448	msedge.exe	89
PID 1448 wrote to memory of 1416	1448	msedge.exe	90
PID 1448 wrote to memory of 1416	1448	msedge.exe	90
PID 1448 wrote to memory of 1416	1448	msedge.exe	90
PID 1448 wrote to memory of 4376	1448	msedge.exe	91
PID 1448 wrote to memory of 4376	1448	msedge.exe	91
PID 1448 wrote to memory of 4376	1448	msedge.exe	91
PID 1448 wrote to memory of 1876	1448	msedge.exe	95
PID 1448 wrote to memory of 2656	1448	msedge.exe	96
PID 1448 wrote to memory of 1876	1448	msedge.exe	95
PID 1448 wrote to memory of 2656	1448	msedge.exe	96
PID 1448 wrote to memory of 2808	1448	msedge.exe	100
PID 1448 wrote to memory of 1500	1448	msedge.exe	112
PID 1448 wrote to memory of 536	1448	msedge.exe	113
PID 1448 wrote to memory of 2260	1448	msedge.exe	114
PID 1448 wrote to memory of 976	1448	msedge.exe	116
PID 1448 wrote to memory of 976	1448	msedge.exe	116
PID 1448 wrote to memory of 3364	1448	msedge.exe	118
PID 1448 wrote to memory of 3364	1448	msedge.exe	118
PID 1448 wrote to memory of 3364	1448	msedge.exe	118
PID 1448 wrote to memory of 2248	1448	msedge.exe	119
PID 1448 wrote to memory of 2248	1448	msedge.exe	119
PID 1448 wrote to memory of 2248	1448	msedge.exe	119
PID 1448 wrote to memory of 1376	1448	msedge.exe	120
PID 1448 wrote to memory of 1376	1448	msedge.exe	120
PID 1448 wrote to memory of 1376	1448	msedge.exe	120
PID 1448 wrote to memory of 4436	1448	msedge.exe	121
PID 1448 wrote to memory of 3824	1448	msedge.exe	122
PID 1448 wrote to memory of 3824	1448	msedge.exe	122
PID 1448 wrote to memory of 2292	1448	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://firebasestorage.googleapis.com/v0/b/zmbspnwoneto.appspot.com/o/alldman-ooommnne.html?alt=media&token=7c91e5e1-76da-4b05-aff2-5b50e494457e
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x260,0x7ffd46fec188,0x7ffd46fec194,0x7ffd46fec1a0
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,3935687907524072995,504167729260084635,524288 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,2567439579172768462,1413188786903335589,262144 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,11850981227515992774,3036133072354689178,524288 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,13485652144759871503,5411962053781014844,2097152 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,11804861041924004016,3882642705543780203,2097152 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,126713668642586093,10686653058335632949,2097152 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,14228947551294231800,9206166581142072957,2097152 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,16647703454059585891,17705292156918659768,524288 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,16273108003298760006,4429724957051867607,524288 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,15881773077867440746,2963696172591535970,524288 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,15881773077867440746,2963696172591535970,524288 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,14534042879760597725,1315131023982523744,524288 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,1037807481984632789,12806252888969916233,524288 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,9745238312311010025,12392737793234286021,524288 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,14057004070040077884,7380231095772523169,524288 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5692,i,14508951548038126069,17670798890385498470,2097152 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6404,i,7337154317349478313,3874593419468976153,2097152 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4356,i,9484761492956566040,9672836942302629689,2097152 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,17661424264559741433,5029804598861338069,524288 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,16108384995974204494,6222946086680829625,524288 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6912,i,12147851156419849466,15489655085941245365,262144 --field-trial-handle=2272,i,18212719802174296901,12864371922909928586,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

5ba214e3-86d9-4bb4-97ff-5bd91b4f2bf3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5ba214e3-86d9-4bb4-97ff-5bd91b4f2bf3.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 56712642283b181bfb018b0c625ab0e02b3def2fae77fb0dfd868c41eb5b8848
MD5 ebb63d548f1d6adc67f4bd38c4fb0e70
SHA1 84591dcae90619555c9a911c50904aeda144365c
SHA512 abfb4490c8898a666398ef0d7029484d9c92d646aed41a79e69b10f71bc804593f7a942985d3111b9425120023ad00b55be07f2dce7592c324b58399da4cd0ec
TLSH
T191716F7803020061EBF01171B7E221DAB475A8ECFE579D89302C44F96AB836DD51DD6F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 56c45eee3d0b3a56f394c862684905c436e04e43ccaaf5736e84d3ef43dd0949
MD5 42a46321320f728a5e90f429d8d025f8
SHA1 ec7e4b02b059346b0c6bde3ed2ea0d9b23374f06
SHA512 92510e95c643ace1a4265ed309ad098e5b36f7cd5cad3f6e055b1c310ac2d87d529452503a1766250fb69a0efb90736912d2bb5a230367fdde8a58d0793414c3
TLSH
T1317170B503010161EBF02171B7E224D9B07579EDFE6B9D89302C44F92AB836CD51DA6F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 34d5f7916b989ce8e7da2fc9f38056000ecc5a6302207a1e66ba7a72e4ec21e6
MD5 207247d8c67a775e6669cd69ebb9be97
SHA1 35c97d4f4751025a1ffbb1ad3f387cef4b949171
SHA512 371005a60660803c7f727c3839e9ff35573e516101f9d18e21e06c300139f91ee622efa92f1697f23e83feb4f6120829a370da21fd9b5cbe587ed3a69094721f
TLSH
T10C31BEF383E5856E8A1156F09A28BE2BCE1D0542436C7D5A85E4EF2793E3475E001D9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d5d16d9714acaec7941186aa1b93d8bea72505a397c006c8f07e3309d35e391f
MD5 65c2b22c04bda4bfb457ad25f44b319d
SHA1 21e32856dd01822c1ee9cbfa8944893e15596d4e
SHA512 22f9e4f914fc0bbe36fe6f5e5a68b4b0fa884d54fb53cbb6b5bf1f305cebde2bf54a03bcea65dd19aaa98d0c8f3cb9863106e78c11026731529bfa1bc7012a11
SSDEEP 192:sxZlRSk4/ffsFJW07V5IdpaaHW6+WNZ/d/YvSddn7IgrJ:sxZlr4/ffsFY0sJHbX/PT9
TLSH
T10A22B8526E38A9378CCBD21DBA15BF53D6F95032A1D51E58AAFC961C04E77CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4cfdd31d8e291d0ed53ef4fba2ccb307a0a0103254a27ef928183467ab87ab99
MD5 8964546ef811feb450ae2a6389da60e4
SHA1 3423e8ce1d3f109167052232fc6361397aaf0e60
SHA512 f23da293edf40c15f640447cf3a58549f642c0e79931156b78d84aa5948f58ce1f84fb9a866a3f369eddfe79de0cc39d02248033005a422657df558c38c50084
SSDEEP 192:sxZlRBk4/ffsQJWJ7V5IdpgaHW6+WNZ1FoXYv27Uyn7Ig5dJ:sxZl04/ffsQYJsnHbLeXBBTJ
TLSH
T16E32B7526E38A9378CC7D21DFA15BF53E6F95032A1911E58AAFC961C04E7BCD320781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3e9609a6740fa87412d826d24b6d0b2f7da3edcedba21030e3907fb0e37b7a86
MD5 2049a0755ea0d8bdf01488fd71154bb6
SHA1 a0add69750f92d59c4733c862da5fd98b5ce812d
SHA512 320be69d46a3999159bef8d0bbc6519b11fe3567e9956d86cffbfe08a5480fe1d289359058da68d71a274b5f90b026ead8409fa54dc69763d77e924d6e1dc2c5
SSDEEP 192:sxZkRBk4/ffsQJWJqV5IdprRY1HW6+WNtzItZYvfUyn7Ig5dJ:sxZk04/ffsQYJPyHbaZsTJ
TLSH
T1AD42D9526E38A9778CC7D21DFA14BF53E6FA603261911E58AAFC961C04E77DD320780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0f672d7eec8d34a588046871c61ae21f680d1f02473095f08b938fa6a6d947c4
MD5 30c4a5b5747f60bc82b93aa82eb883cc
SHA1 84d725b85b2c978ea64f91d328750d413cb92271
SHA512 1fc70f0050dee757a2a073fb7f2ef26e0160cb244b188b2acc08a0e3886976bc8d09ab85e2a3e9b0bff67644b72d3f818e23db83b886817d5244ecd0405d3b84
SSDEEP 192:sxZlRSk4/ffsQJWJ7V5IdpaaHW6+WNZ/d/Yvundn7Ig5dJ:sxZlr4/ffsQYJsJHbX/RTJ
TLSH
T12732C9526E38A9378CC7D21DFA15BF53E6F9503261911E58AAFC961C04E77CD320781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5b8a71933d42d17e7970a7636761ae404657193e51ff1fc4abef45a6cb159e94
MD5 1079ee2aa18079f8373c375898c638d1
SHA1 25f5043c6278c0f125f291aa7e731d889b97d226
SHA512 45c5034f1171ad650e09aa1c507c46796ed3cfcb921a30ef81e5d08df82d3d2718f019a4e2e4fa92bfe118f847f90a6b5a77528361270c9fbd67190341bbe011
SSDEEP 192:sxZlRSk4/ffsQJW07V5IdpaaHW6+WNZ/d/YvSddn7Ig5/J:sxZlr4/ffsQY0sJHbX/PTX
TLSH
T15122B7526E38A9378CCBD21DFA15BF53D6FA5032A1901E58AAFC961C04E77CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fd9ca558471e6f677fcbf872eeb9c247561275addfbc34a318b8db0deac60796
MD5 08de875ab1e6106bb52f4fcfcdadef55
SHA1 053fa165360c625b853081055144b3ff9d0e49ea
SHA512 95860ee3a3f47f880424cec93bee5510e49216f66b644be9f8c033c7799701d2d8ef310beafc8e14a9594b8d26a2dc8304c1b2df6cc6175cda0eed8ac5fe2f92
SSDEEP 768:Kpee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbprolO:Kpee3rxWvhffnu1jatcL88bClO
TLSH
T15AC2FA2B640CCB7E5F800AADDC5A6F977FA802C7A7548D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1e40f77d6975b7f31fb9417daae1d07e13c703f3915b4ef1bcd40b14d972ae5a
MD5 63a75423b5909b26e3cfe1a458bf8eed
SHA1 e37f62c6857312bf46e9f594c42e851829aa34e2
SHA512 8c11dce489c6141955a1497434b75ecf6d4f0f3a557175e17c93af1dc64b1b47ecff54d69398b7b6aff51484ac14ee8b3da24b10844e42660f8f4e0a5250800e
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EK:KYHIhKggkXyh+IHKnKIXyxmIHKbaMU
TLSH
T1BE916616367B06423C7E2848B6A796374F4232A73454E8AF7FB854A10E26E112DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53a4ec79-573d-45e4-bf66-8eb671634b99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\53a4ec79-573d-45e4-bf66-8eb671634b99.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 35d3ca1604c52d839f80e531683d6ac0b71f7b1d7fd915725ab7b11fcbc723a8
MD5 27155454fe1a0828ec30e323ce0ef938
SHA1 d99104d6b26901a8182f0764fd5719d772da1b48
SHA512 6fe4d0ed457e25b2aa76ac8a8c61dbebc334a427f7aac7cfbdb2e292d6f6fb895e0360c888fa78213abe630b8a7cb7f24b1de55d57760103b0c94dfa8d6574cb
SSDEEP 192:uRm+xasuheOwQxMGsNnVQgK7bM7Sh+dQmiU1gE/4MTwz+FdLD1WSJrV8z1/1quG9:LZcIhsNnVCE76+b7w0dbJrC/PG9
TLSH
T15F626D715C74AD7B99A3F185F48A37034EF8E02796C46A54E5EDBF1D00DA2A8130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 9f9ca7bb2c461f5d15326aea47603f125739c6d9ef2f766f57c1b1a373d5764c
MD5 a4af6d0d3fb4668359d92e7c3ec596c3
SHA1 0e92754b8b229d4b05a1b8d540895bc7c28bc0fe
SHA512 f0f5be7fb641b441ddc9dbd9d04f03720ac2b3dc933b715fff42ab513da17d0146d1e31b0581c9205ba5c1493a277b713acfb531336f20e2138dcda26a6810d3
SSDEEP 384:rriFiZcIxzsN58TUNTUlIlECE76+b0w0dbJra/PG9:yFQB4wgXEgXVha/PG9
TLSH
T14EB219F248E7883AD96EA747E77D2E034EBCD067B5809550B3D86A0CCC861BFD306912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ddf530858b7bc097400794b2885e0c319aa710b2879275ca1ac52fb587805a76
MD5 c5dcd36b75ebd9079cbfe3344a3bda72
SHA1 0c720ed37a2e043603d5f15086d15928732fe5bc
SHA512 d3eb743eb31e73aebe1c29e400fb28bb7dcb2bb77cc4a30b275e1bc28cea6537ae65e98460c602ca62dea1a9be7c48de9efa3fbba2cd48a748710264794ab0fc
SSDEEP 192:lONr6vMtPQmiUy0dThTwz+FdLDf847/q6U/u:lONr6UtRRTnd//pU/u
TLSH
T18B02F935BC786C6BDAA3AD49F48A27175FA4617FA9D05B50EAE82F1C00D765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e63fb86ed1d75028f6d4daecea2be3f91ae05b6f2dceab455df3d475319156e0
MD5 6fb695481e7207a64d34e5922e91ba0e
SHA1 865e79354d9ef0142102fb4897c5e31b3e601ed4
SHA512 66c0d9d73c61a3078163eb07dd51039a05864230b7bbdfd41615d2799dc53e309cb1d8d52eae69532951e0d1fa2ae2fc4c32cbcb827dd85a561cd3693f3cb544
SSDEEP 192:ukRm+xasuheOwQxMGsNnEQgK7bM7Sh+dQmiU1gE/4MTwz+FdLD1WSJrV8z1/1quW:TyZcIhsNnECE76+b7w0dbJrC/PG9
TLSH
T1EF626D716C74AD7B99A3F186F48A36034EF4E02796C46A50E5EDBF1D00DA6A8130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 ecf8e85997d649736b651f8517e7038690d14d473d2b100a6f773a4eb1a3abe2
MD5 30e1e572fc8138fcae6544b67fbae985
SHA1 3b37482fdcdd329e526e6be4c894e1c889d79a67
SHA512 4c593d29393e1477320a2ae23496e67f523d99b08dfcb072777f45dcdce38c651cbe756035ea9b91c43c87131e759644c2813226fda37b161902c683120e0ab1
SSDEEP 192:yONC6vM/PQmiUy9dwhTwz+FdLD1WSJrl80I/1quU/u:yONC6U/RuwndbJrq/PU/u
TLSH
T1C3120935AC64AC2B5D93B585F08B32175EF4D16B9AC46B60EADC3F1C01DE66C1307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a56bd3d-b624-48a7-b178-1e4f68c87a8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3a56bd3d-b624-48a7-b178-1e4f68c87a8f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dad559cde468ef3ee105f1f3326a0001e2f44a3af336791525e44c85d31e2446
MD5 a96f17ff30c56062303f9df77692e282
SHA1 a738361a59ab8e110d4a088d4d193809a77746ae
SHA512 e67f84ae9d160d52c4cf2692a5fb81f40b6733ad6db2987164ea253a2f696aeb2d53de926b15c989156a94e97a091de76dee31c535c7c4bad7db5d1979df059d
TLSH
T118411958B6F91148B3776F0A9BF6A96D487BBC771E07D45E10110D4F0622A44C972B73
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download