hxxps://py[.]md/8f7t6?test-030-8202-615-21-14647=audit-service-bandwidth-support

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://py.md/8f7t6?test-030-8202-615-21-14647=audit-service-bandwidth-support
Sample260804-txp4sssvfz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1540	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303343959473169"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{BD78BE9A-9339-4013-A194-DC1F3328BD6C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1844	2792	msedge.exe	85
PID 2792 wrote to memory of 4980	2792	msedge.exe	86
PID 2792 wrote to memory of 1540	2792	msedge.exe	87
PID 2792 wrote to memory of 4980	2792	msedge.exe	86
PID 2792 wrote to memory of 4980	2792	msedge.exe	86
PID 2792 wrote to memory of 4984	2792	msedge.exe	88
PID 2792 wrote to memory of 4984	2792	msedge.exe	88
PID 2792 wrote to memory of 3132	2792	msedge.exe	90
PID 2792 wrote to memory of 1792	2792	msedge.exe	91
PID 2792 wrote to memory of 3132	2792	msedge.exe	90
PID 2792 wrote to memory of 3132	2792	msedge.exe	90
PID 2792 wrote to memory of 1792	2792	msedge.exe	91
PID 2792 wrote to memory of 1792	2792	msedge.exe	91
PID 2792 wrote to memory of 4356	2792	msedge.exe	92
PID 2792 wrote to memory of 4804	2792	msedge.exe	93
PID 2792 wrote to memory of 4356	2792	msedge.exe	92
PID 2792 wrote to memory of 4356	2792	msedge.exe	92
PID 2792 wrote to memory of 4804	2792	msedge.exe	93
PID 2792 wrote to memory of 4804	2792	msedge.exe	93
PID 2792 wrote to memory of 4628	2792	msedge.exe	97
PID 2792 wrote to memory of 4628	2792	msedge.exe	97
PID 2792 wrote to memory of 4628	2792	msedge.exe	97
PID 2792 wrote to memory of 1548	2792	msedge.exe	98
PID 2792 wrote to memory of 1548	2792	msedge.exe	98
PID 2792 wrote to memory of 1548	2792	msedge.exe	98
PID 2792 wrote to memory of 2664	2792	msedge.exe	99
PID 2792 wrote to memory of 2664	2792	msedge.exe	99
PID 2792 wrote to memory of 2060	2792	msedge.exe	100
PID 2792 wrote to memory of 2060	2792	msedge.exe	100
PID 2792 wrote to memory of 1500	2792	msedge.exe	102
PID 2792 wrote to memory of 3468	2792	msedge.exe	113
PID 2792 wrote to memory of 3468	2792	msedge.exe	113
PID 2792 wrote to memory of 3468	2792	msedge.exe	113
PID 2792 wrote to memory of 3444	2792	msedge.exe	116
PID 2792 wrote to memory of 3444	2792	msedge.exe	116
PID 2792 wrote to memory of 3444	2792	msedge.exe	116
PID 2792 wrote to memory of 1796	2792	msedge.exe	118
PID 2792 wrote to memory of 4412	2792	msedge.exe	119
PID 2792 wrote to memory of 3028	2792	msedge.exe	120
PID 2792 wrote to memory of 4704	2792	msedge.exe	124
PID 2792 wrote to memory of 4704	2792	msedge.exe	124
PID 2792 wrote to memory of 1868	2792	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://py.md/8f7t6?test-030-8202-615-21-14647=audit-service-bandwidth-support
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff929a2c188,0x7ff929a2c194,0x7ff929a2c1a0
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,9211917146535219438,4286689771259862220,262144 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,6514674451587926458,13053749590373211116,524288 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,10717707298579692596,8272028846258825365,524288 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,144010942754441349,9664993797888063028,2097152 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,17779088627733197643,1306050457038815705,2097152 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,8192476629864589692,17926719237215181377,2097152 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,7643997692766296297,2018188712009610168,2097152 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3660,i,14149986491320488175,16300319063179400996,2097152 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5264,i,519715810704485630,14950700233895874491,2097152 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,18358652790243477815,5999260271256454537,524288 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,6228377235190820649,11034389928942851992,524288 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,6350773052107517840,9694931198307549749,524288 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,6350773052107517840,9694931198307549749,524288 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5164,i,572946535286138291,1595607014884067112,2097152 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4440,i,8097674608771891477,14119457350963809436,2097152 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,5603329766475532630,8333299422700176237,524288 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,12092762229683387390,14801684734528093735,524288 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,8872710213620825253,3046120003715564565,524288 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,7409337966937914643,242314630526882169,524288 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4232,i,5313168695881464358,2067847273722161525,262144 --field-trial-handle=2028,i,7938158492965484231,13411861972448019813,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 19770e7fe2094711e80964a836e60964de6a8ad16ccaac3d8dfad98369019638
MD5 44dad74e010b183434bee387e897e5a5
SHA1 1e8cd1a25c1805f95db825d1abc631a4dc4b3528
SHA512 4bbc70e7b7329e93d20b196e728888ea0151b121d95738e26f908478d84bd38ac8410bda7f62d907ab7d1206a6ca2df9c6c71f59ce1ad6ea772dbae5c26236d5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 26fd8e6873677812553fbcde72a525b7764e204c7af45761e55f6b01c7024fc4
MD5 bcb3e77b674ea58513673de5c0222810
SHA1 24a97dda65ef5a07c0ad77bd5c6c5c6c6340ac6c
SHA512 c82172d1599782ed75a811bc0285a2e9a441182d1231f7c6070105c5077468e31bf51e8fbef2067a0de66cb8a80954169886d1b6e087930b691b242cd0bf1453
TLSH
T182714C4211567C77EBDA0AF1F4CD4209B8F1CEA50E531FD5155CB8BD9827B63809AA0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 19b03424902bfe28db6409cb7c2a198f567cfbb820f5be2eec475c533d4946e4
MD5 f14a3d220c4285eb541f0aa63ff4b805
SHA1 4430e003348a7131a361631a48ac83ed380ad40b
SHA512 75223ab266e6e3b4b4898fdc8d3e73f2ce367fd70bfc3b760c4ed2857dcd367ddb54dc6c91e2f9d616e47c64045091f787a8cd44ed7ed19b874fee88a4ee4383
TLSH
T18C713B4222557C77EBDA0AF1F4CD4209B9F1CFA50E531FD5155CB8BD9827B23809AA0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ffe7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ffe7.TMP
Size 3KB
SHA256 351ff9d03c6a017f97f6832fc6658638b9c12443f60f8ac857b9db380cfb33c0
MD5 8f5775efce95f1a91c00488868345556
SHA1 c5a0a8315b8b6dbbd3f94378372df12a4e87e433
SHA512 99994d042a2b5e42dcb16bde3dc89eb670eaeee8292787f41b3d177a4eb9f228c547f30daeb2474e266a65582882c1f0d0b895398b5ee43b3760927ac5ddcb4b
TLSH
T1B4715C4211567C77EBDA0AF1F4CD4209B8F1CEA50E531FD6155CB8BD9827B23809AA0B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9a48acadbc683987e93ce4c24d78be6587e87d3c190e7772341c69728c2d1e98
MD5 73cd91f56834fbe2ba1cc52dcd40251d
SHA1 92326e926ec2c90438fdcd58ab4685baa63c8589
SHA512 ab8c39c1a4d44a2988c040248d4e89cc051d6b5f9a03dd7cd7a35306cd29a5ae1615907663d3972ab79ea83a1f7ca76d12495c84ee232bd59b7cc4059ec90367
TLSH
T1D53148B2C3E5856ECA5116F09A24AE27CE1D0A16821C3D6A89D4FF1BA3E3471F10295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b937e976fbdc76d310d8425ed1e4b94cda4befa025678f2c767853ac05288c6e
MD5 ca7821c13b0997893ee68234f6be0aa6
SHA1 19e9c106dc5fc65caa0613f8c5be38d9706d71e5
SHA512 56d274960d63eceb9f16ece9dc603a299001b987c502d4624894cb8c9ef8a135c89f0e26bda14d8f7143d07d42d7139abcfdc01af89e02a44a561f00f7c80dd6
SSDEEP 192:sxZ8R+yM/jK1Ml8Mkk/fBsqSYqNIdpZrkyHe6e356+WNsronIvT/Y45oCawkIgrJ:sxZ8oMk/fBsqSYquFkyHds6KCOT/bM9
TLSH
T1A652E8156A346977CCDBD309FA51BF93D6F91572A2900D48AAFCDA1C04E6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 86c94f4572e8dd3fb91f0ff74127dc83f231c04285d8b472f00f7c07c6e30a0e
MD5 b42b24878519ddf0c23f781b8e84890d
SHA1 dfd0c5f6b8fe33c4b22bafb3328adfa83e700f5d
SHA512 7af0fae0dcbcb71bc57c4be48de0ab59721096dd78633041c19db2b1261050608ea24fa25eb80f87df1e8dc66a0beee73cb47e5e0c9d5d9ccecf65109b3250d1
SSDEEP 192:sxZeR+yM/jK1Ml8Mkk/fBsFSYlXDIdp5ark8oHel356+WNM1PronIvT/Y45oLUwF:sxZeoMk/fBsFSYlMWktHq6yCOT/b1U
TLSH
T1D262D7156A3469B7CCDBD319F980BF93D6F5546292900E48AAFC9E1C04E6BDD2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0d71f6bd242f128c22c6972904b599c5c650618c01efd343fa54bd3eb22739c0
MD5 f2096b3a5eefc9335b86625ccdbb76a6
SHA1 756e3478888d97f32b410238394e1649a5109478
SHA512 26996af0c6e85cbef00a6d839558426eb8ad6b5a271782703d596e1202220a1275d7accd98b2e1fc4d6abfa93ebdcb13b620fab5cd0f6b0e5388317a3a21ddaa
SSDEEP 192:sxZeR+yM/jK1Ml8UQskk/fBsFSYlXDIdpjark8oHel356+WNM1PronIvT/Y45oLC:sxZeoq3k/fBsFSYlMUktHq6yCOT/bOU
TLSH
T1D262D7156A3459B7CCDBD619F980BF93E6F5547292900E48AAFC9E1C04E6BDD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b8133c750222d590593afe268137417659a5fd9f727bc89a82d4e9bddcdce0d5
MD5 e60ee21d5b3312af637683b3fcbb40dd
SHA1 58a452b91e006794ce37a1036928e364b6478e02
SHA512 a4396ecb0c9093f39207f482071e2a9c0cc8b60def3644b73593aba43a04c45d3128a143960249abe4e126a7207bcfd4abdf6ef92f39fda5a4058cbe2ceab5ad
SSDEEP 768:JN8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opderoekHUn7:JN8iJPNWvx76ru1jahALocd1dU7
TLSH
T1EAD2FB3B680CCB7E4F844E9CEC266F966DD801CB6B944D5447FA884C03C76EE51265DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a05c31c8cf3cbabb8d27997c050bfd8a710cdfdb51d928fc3a5c4bc6c3124933
MD5 33971efa3729cd96934b9a976a3d9a45
SHA1 434aabde4b643fbe690dfd08c8b3cde5c3372b1a
SHA512 e6eb6b4187ba4e1a7927d9d0ff1f908e6e0b059eb94dcc19b0cceeb4610e35d580779144a704f237794beb90c7dfeff3a0e2835244b29a47b24a3e579a81555c
SSDEEP 96:KgvmbPVdd+PtklFv+K9LFR+p3v8B/fs4AKdGugwKhuWl:DvmbPVddItkfvvLFRU3v8B/fp2/l
TLSH
T1E591930171BF16832E3F2548D6518B67679270633408E42FB7AE41714EA6E250EFEDDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599d40.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599d40.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9d1b89583b5a1dccc74e941d284d6a24fb8f4cf44257e95413a11bf44b41af01
MD5 938a98e6b3549da13b75b5e6a846a43d
SHA1 577fc82b36894a3c91b3c31bbea1601d1566f3bc
SHA512 b122b4b08200cd150cd830956991b9bad53a781981f3a955463233e2d75f35170905a57a9b5f7f909c78e0ba373e880a4aff73a8f063344e42fc34a714aee94a
SSDEEP 384:hiFiZcIGzsNI8TUNTUlIlzKHFPpkBgktq+BeRs9JKgqijUZhOG8:IFQ2ZwguUHTjKgqmUZhOG8
TLSH
T1BED229F244D7553AE9AE9B43A77D2E074EBDC067F6846A94B3D8590CCC861BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f3dac7052e4cc5c1a18d048dd74d1bab6fb0b824d7ede80e8305cf1f944a2b66
MD5 758b62fe1db84b1416b19f0b207026ca
SHA1 4973b1c4c441f265b8e1ac038ad88166b66c70c1
SHA512 3562337f11b5c6f49b691a2d033926f918ba884c672019909de9d9cd978e0ec46f7e9bf40c266942fea9f952429ba05e58d396d365024669f242782a9fe4e697
SSDEEP 96:ZqONkWQsjpfmUTmDK5ih/cIPURHl8h4otop5o5DyBhPwivh50xy0SFYK+AxADqQy:gONS6kDfQmiUy6SZ903SQi/FjU6
TLSH
T14502F9396C782CABDEA3AE45F48737275FE5212BEAC52F94D9E81A1C40D724C1347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c28652809290d315399770729496495e222672340b676da491d49040da69ed11
MD5 0870fe303fbb02bdaebee025545de58c
SHA1 198e4edf686679d5534e2a8c0d40123ab337138a
SHA512 c0f36abbadc9d9fd876fd631bda844cf2b88b3303b3a836c836791ae9f74bb3962111c06e4c9a80792f5adb9022f63d977170306456f7b50d8cc4cd43ee2911a
SSDEEP 96:YqONkxQsjpfmUTaK5ih/cIPURHl8h4otop5oXDyBbPwivh50xy0SFYK+AxADERxu:DONp6k7QmiUymSL903M6NkTcRMqM+U6
TLSH
T108122B3668B86C6B5DE39945F08733175EA5922BFBC97F94D5DC2A1C04EF25C130B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 75c9db513ec436f7047e9b337deeb992fabf1632cfc5f7395723409639add056
MD5 ca3294cc701bcd5262e16d9df16d70e8
SHA1 0f920338d887265b4c3d91f3e1556ab22a8cd978
SHA512 9ac662b9f08794a4532b50efa28e1cedf8b57d8c66804026b438a2dc48f9bf0fca8f81f1983eafda9990e14257c20b35d430616295577f887924b734884439e6
SSDEEP 192:uFLsNYWQcuowNbQOCmD3QmiU1j7m4k03M6NklLIMqM+6r7:CsNYWKHF1pkBgkyq+Y
TLSH
T1B8424C3668786C3B9DE39641F04732139FB5D16BE7C82FA8D5DD6B1C04DA2AC130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 dd5c28bdae666e55b4712638bb05152d86b753b2d4075f5cee4cb7c5a8a3378e
MD5 73cad7f0d6e4d1268ea9401bf299fb9b
SHA1 d7835c1f56f13a7b50ef0571745fd56ae7899259
SHA512 202d3a6e232868c8418e1ef90d9ab59acaf342df0c3dceba2677538615d9c790e8954299aa8c873ff7165fd16e29c538d04baa7d523b9f8f48532da759848c74
SSDEEP 384:CZcIhsNYzKHF1pkBgkyq+BeRs9JKgqijUZhOG8:whi5HTjKgqmUZhOG8
TLSH
T162929D315878692AA9F3A981F48737175EF5D027F7C82FA8A1EC6B0D05D669C030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18099bfa-2fe3-419b-955c-c988ab0da4cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\18099bfa-2fe3-419b-955c-c988ab0da4cd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c52b01fe7a25527bcb3eb268a2b8839753efdcdcb3238669b7d3a146422baaa0
MD5 b1ad2e1484810a25786a668c2ca41d2e
SHA1 de5a1a8349e6cd91c99eb26413bff90af50b7bc2
SHA512 99aaba89f25214882e9ce6d51b77e924139f017be2327232fea05848df6b3e623b1a3deba56cbd802271bb585bb9dd4a56f0c5b15cd6bd847ae05a233081690e
TLSH
T15241F66DB6EA5148B3B76F5AABF2B86E487EB9231E06D45D10110D8E0763A00C961737
MD5 SHA1 SHA512 TLSH

Submit Download