hxxps://sensepc[.]com/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
209s
max time network
205s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sensepc.com/
Sample260808-2bz1waff49

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
35	ipinfo.io
36	ipinfo.io
39	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5048	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307015427202993"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{E775FA28-599C-48D0-90EA-9957719B3784}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 4348	3524	msedge.exe	89
PID 3524 wrote to memory of 5048	3524	msedge.exe	90
PID 3524 wrote to memory of 1304	3524	msedge.exe	91
PID 3524 wrote to memory of 1304	3524	msedge.exe	91
PID 3524 wrote to memory of 1304	3524	msedge.exe	91
PID 3524 wrote to memory of 4188	3524	msedge.exe	92
PID 3524 wrote to memory of 4188	3524	msedge.exe	92
PID 3524 wrote to memory of 4928	3524	msedge.exe	94
PID 3524 wrote to memory of 3356	3524	msedge.exe	95
PID 3524 wrote to memory of 4928	3524	msedge.exe	94
PID 3524 wrote to memory of 4928	3524	msedge.exe	94
PID 3524 wrote to memory of 3356	3524	msedge.exe	95
PID 3524 wrote to memory of 3356	3524	msedge.exe	95
PID 3524 wrote to memory of 368	3524	msedge.exe	96
PID 3524 wrote to memory of 3764	3524	msedge.exe	97
PID 3524 wrote to memory of 368	3524	msedge.exe	96
PID 3524 wrote to memory of 368	3524	msedge.exe	96
PID 3524 wrote to memory of 3764	3524	msedge.exe	97
PID 3524 wrote to memory of 3764	3524	msedge.exe	97
PID 3524 wrote to memory of 6024	3524	msedge.exe	99
PID 3524 wrote to memory of 6024	3524	msedge.exe	99
PID 3524 wrote to memory of 1248	3524	msedge.exe	100
PID 3524 wrote to memory of 1248	3524	msedge.exe	100
PID 3524 wrote to memory of 4436	3524	msedge.exe	102
PID 3524 wrote to memory of 3268	3524	msedge.exe	105
PID 3524 wrote to memory of 3268	3524	msedge.exe	105
PID 3524 wrote to memory of 4104	3524	msedge.exe	107
PID 3524 wrote to memory of 2996	3524	msedge.exe	108
PID 3524 wrote to memory of 1812	3524	msedge.exe	109
PID 3524 wrote to memory of 2924	3524	msedge.exe	110
PID 3524 wrote to memory of 2924	3524	msedge.exe	110
PID 3524 wrote to memory of 2684	3524	msedge.exe	112
PID 3524 wrote to memory of 264	3524	msedge.exe	113
PID 3524 wrote to memory of 264	3524	msedge.exe	113
PID 3524 wrote to memory of 1852	3524	msedge.exe	114
PID 3524 wrote to memory of 1852	3524	msedge.exe	114
PID 3524 wrote to memory of 1196	3524	msedge.exe	115
PID 3524 wrote to memory of 1196	3524	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sensepc.com/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fffba0fc188,0x7fffba0fc194,0x7fffba0fc1a0
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,16495614785665220516,16904475253230491011,524288 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,14127557057172705339,16174452037465089622,262144 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,17409488317817737708,1856133890727393565,524288 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,11211280479584072076,7940162936397327425,2097152 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,8368168733591766623,1641634831632910973,2097152 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,1581216115458911352,16294046875280279037,2097152 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,8327932582561440358,14966799854518237730,2097152 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:9
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,10855407946654487142,2068803615200628802,524288 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,6923680553693256693,11633773345617207429,524288 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,10856516657889802236,9243555482005417881,524288 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,10856516657889802236,9243555482005417881,524288 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,14819736053775865054,2820901553971360199,524288 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,17749251320591774460,670419550797865465,524288 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,552777601031580500,7533483854073138716,524288 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,3886697576730722829,5577961739505367616,524288 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2668,i,15870629751498728796,15377725553369338572,524288 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5164,i,7796027255374095340,8127662983675837472,262144 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,17982772613552904670,1585573212543012253,524288 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:14
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3352,i,11883948562169184233,9479277328052225845,524288 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:14
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,9273378737842735806,14064568291528997541,524288 --field-trial-handle=2300,i,7704409019846568354,11704269815880852639,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:14
  2⤵
  PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8a425a3aa44b3f140bd334e1ae7caa3adee58f7d9fbcb14354c55c745ab97edc
MD5 64d5ef3c4583c3c0383ce4fd1d374500
SHA1 20d716c17ec3def6c032ac26941a2a690701d5f8
SHA512 1cb0eb4463633a5fa3b18f3acdeb15f27da7115f768645ebef74e735a3814bf956babbcffa71a1d0ae894cf410baf8e8ec83b7497e8fbe8ef1871d63f96cb144
SSDEEP 48:LBaSW50EEo8+iQGwjiCE+Tc+Ssn0+13pPnx9lhcQQPP860F/:o50EHxGwjiCfTXV13pfzYPD0l
TLSH
T1458144DA1BA509D2DB2155FCD4D2DAB4B5F4647BCA0B1B0380341D3D6CE2F98A9C5623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5998db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5998db.TMP
Size 3KB
SHA256 2544ebd732d2e0d48a3c0106100355916f3ed979e07f7ac3d0a35009c41b330e
MD5 2a0f7baf372655cdd07529bc2eea02ce
SHA1 0ec9fb73677c27edcfc758fdeacc4493d1f9e5d5
SHA512 5c7547bd85dc59a3612f8ea155eb2082db36f059f1d2e320595a46be4ca7bd33bbd1b34dfec081593becf69f62e42f5181ad0021b79e5cc8a10a27a70ad6d711
TLSH
T137610DDA136509D2EB2155FDD5A1D8B8BAF8847BCA0B2B0294342D3E5CE2F185CD9533
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 70cf7a442a65988c063e98ff0e4d1242c0f47fbda9be9ed9ada361cc4d618a43
MD5 ac6150289f8d54d338cb528b9672d9ec
SHA1 7f8f16d9fc885b56cb5f8e06b627b8b8988a40c5
SHA512 c7d56187e37b1ffd2faf1ab933437e416df97a7d0b09b65b38eb1071fd94d6de5dd3b7c8f3a13b83ce655346cc5a683aa8cc45096502c148821ffee943364ed8
TLSH
T10051AEF383F4966ECA1191F0AA146E1FCE6C0525432C7D6989E0AE1793F3472F141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bdf77f8ada4e9c6cbf2789565b2622a6e33c052c81603d3c610176c3c13dae53
MD5 90c36a447c7dc215c5f4e8f82be12028
SHA1 25ecc930571299219ab6a55381b4507c1b5f08fe
SHA512 b81e76b86de64699146d783cdd4d1edb9e272f3f0093a7068021e97e1bb50396bfcf72d096c4a394e2a76a54b2b3d643694607ec6a07f6777d58448d11465882
TLSH
T1D321CDF7C7E8567D894181F866242E1BCE2D0C54831C3D5AC8D4AB5B93E1871E24095E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 96984b3dd1d1e33951e0da0fcdc61b631aad235a5567818fc86c05f45d980cfa
MD5 e857f8e63bd6eae9967e9e7f316af2c8
SHA1 00a1f4203ab5db47cb906046643c42d1d5782322
SHA512 016f80deb0c3737bd6328bcc500f17d6a70ebbb81afe5627be2682d9fec3893f0a33f2e2b0fca7599cc6e3b3a0d51808737e9dd145d74d16b52ae61541dafe9b
SSDEEP 192:sxRnRobg/fxsNVYCb9zoA8pWx/g6+WN6a5/YEg532GZdIgDmJ:sxRnog/fxsNVPwC/5B/2V2
TLSH
T1F742C7166928AD3B4CCBD25DFE65BF63D6F9143260901E58A7FC9A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 258c6ab16009a44021741a50b676bec89c25bc9d200685a07c3f6a28c9e55bff
MD5 35a38a2fe13369294cb3fe91f868c0c0
SHA1 a59286082c68c62a293eda76d7a1e19ce387b4b5
SHA512 f7ce33cb1a343c637dace89e44ae0cac2e20e7780f0b0e8ed06577ff7cc6ef1b3ef7ac393c624bb6f0a5b09ba34157bca3ec5ac5db8e23e77bdeeb232b81ec04
SSDEEP 192:sxRnRoBg/fxsNrYCb9zoA8pWx/g6+WN6vUXYE3632GZdIgD8J:sxRnag/fxsNrPwC/51XeVE
TLSH
T10442D816A928A93B5CCBE25DFE657F63E6F9103261901F58B7FC9A1C00E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9108777254046f5bf23b524bca79a187795509aa034fa4e5aed59cfee222b613
MD5 049e7c0c0783f1169fc6145bde6c6344
SHA1 62c64522b820b01a890f77dcf5149888dea39aed
SHA512 4edc10f2a8000f03b33398b8b3cdb02769a84f18a57421a9007bbe654b296b5aea0b7def2c1243fe270fb904eb5b5f2485fde06debeb022df311a5477c566b5c
SSDEEP 192:sxR8Robg/fxsxVYCb9zoA8pWx/g6+WN6a5/YE932GZdIgQJ:sxR8og/fxsxVPwC/5B/NV0
TLSH
T1CF32C7166E28A93B4CCBD25DFE55BF63D6F9103260901E58B7FC9A1C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 c9c7dfe7a7b0e88431886ff54426008539e692d990eb8e6ac0f5a927abc677ed
MD5 2a8349952895b00e6c8624e2b3ae05d0
SHA1 bf41fd5067627de2abeb2acf6e7d815bfe327b62
SHA512 6e3c47764cdc39518d3ba74d8eb0c1ed1f64e2107bcf95ab9353cdb14e853b83c419465030b15e5005c7ac3efba315f13d2ad5606bdae3a8287eb8ed986f9b8f
SSDEEP 384:40DxK6DJQD810DrfCtgQ6DRFfIQDFKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVE:40Dk6DJQD810DbWgQ6DjfIQDF8F1+UoR
TLSH
T12FB2DB2F640DCB7F5F804A9DAC19AFD76D9802C796988D8047FE990C02C77EE92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

4fad389c-fc42-47ba-aade-726d29f2a358.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4fad389c-fc42-47ba-aade-726d29f2a358.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 588d539162cf7f78ca8b748adc7ac5bacc18bcf81ec8787da68df8677b0fd432
MD5 6e07b2b6cf715edcfde8794795f060da
SHA1 cda50a2a9575c3b893d8dcfcf59d8015e8b25b7a
SHA512 3188852316b9ba47376980a66cd37fcc5cc398f96bfc2a145ea196f2de7c3a51ff12583ac24e7b43c2eb2d138fa742213262da266134723a30cdf771b9146269
SSDEEP 768:1rv+4UNbdp38mUaDTd+Z+RC+eX6+qTko0u229a4vsTRqN:1bsbr3j+ZvVTVKa4UqN
TLSH
T11C03CF32F8659D778DE6D2C4B10771472F7811638AC81BA8DADD7F8D028B5AC270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 dcee76b43fd5a79e7f3f8bce0ff785e397b8527deb67a73237a9dd13ff32e513
MD5 fcb17c475612877ec539089d67943189
SHA1 b7da1755a354c70dabb678e72b9059d85510c03e
SHA512 613e3656b7073be5cc06d1109453f172fe09621b96603d9e132e6fbc0e15f482fc53b5d01fccbc4500435fa1cb2ebc7afa3118348f2eacb65a64c04a00b94777
SSDEEP 768:vi38cUaDTd+Z+RC+eX6+qTko0u229a4vsTRjLwYr6BuM:vi3T+hvVTVKa4UjLwYeBt
TLSH
T1C4F2C071F8626CB34CEAD284B60732479EB51173C7C85E949EEDBA0E024B5AC170B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 294a62afb20d17c90bd4ccee55cbd3ab59719ee374ce36c1f5110ee52564c6e8
MD5 6cb5133942d594dce0865dc60d3b57ac
SHA1 4726bd165d5ff327757b372c6eca6b36538a2edc
SHA512 e89db46d8e23782cde8c3681d54a6454a94a42f44a2aa187879e0050e2d80c4b1a6115c4821d5e596413fc8697852be399d382ec89ec3ee7fe71f41dd602e966
SSDEEP 768:0i3vcUaDTd+Z+RC+eX6+qTko0u229a4vsTRjLwYr6BuM:0i3k+hvVTVKa4UjLwYeBt
TLSH
T1ECF2C071EC626CB34CEAD284B60732479EB51173C7C85E949EEDBA0E024B5AC170B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 e89e419eb50cd446fcc864289eba39c2aa5b0748ab0f4d37f14338ec4b3036cd
MD5 12a811268352d64df722910031ebd42c
SHA1 49bffcb065fad2ba5ce42e27054dfe511c3b93d3
SHA512 13ec429809e98938fdc22ff270515d3ab41634192f3fe876482f9bfd6da6a3ab949281b3617393ca2df66cba158cbcae53909c98e88cec9ade35854ffb745600
SSDEEP 768:Hrv+4UNbdG3q5YDTd+Z+RCzeX6+qTko0u229a4vsSReVH1SdW:HbsbU3MGvVTVKa4jEH1h
TLSH
T15103CF32E8A49A738DE6D684B14771472FB91163CBC80B94D8DDBF4D064B5AC130F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f2c1401e43075e09956054339a22fa6320ccf48314cd69f1e8f37fbbcc496b29
MD5 cffd26d5db14343539624d8302318564
SHA1 fcd6e30d98a4ea61760348df65ef47a7d59217ca
SHA512 9f842c6063e9ddcc0ebd8cc67d3fecbe5d7bb272ca4a02fb702c1d94728cc0ff9899547fed29c45b2af10aab1a252811387b495a001c0c8549ddf903603fda43
SSDEEP 768:HFVr38wg9cUaDTd+Z+RCeeX6+qTko0u229a4vsTRjLwYr6BuM:nr3h+ZvVTVKa4UjLwYeBt
TLSH
T18003C072AC9199778DAAD7C4BA1732079EF50173CAC4AEA4DBDDAD0D015B1AC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b2c8d304312cb340692e975088b323320835fb2981735975c90c6f68268af4c0
MD5 8a5e37efeff9bfb4a72b141a9b780938
SHA1 4db5befc9f9650200183fd422a1c394a807cf72e
SHA512 6ac2770edf09871b5966a88008fd67dc6cbc566536fa8e58c961bbdef3b75f3aa40494eedebc8f30f8465a597c2a754096026a97ef65cb1fa1d124a4be7d01b0
SSDEEP 768:prv+4UNbdG30OTDTd+Z+RZeX6+qTko0u229a4vsD5eVH1SdW:pbsbU3+hvVTVKa44EH1h
TLSH
T10F03CF32F8A58A778CE69788714775472EB91173C7C80B94D8EDAF4D025B5AC230BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 11a4b0b322f3bf8d62d422ed033393513ab44e0a01efa2b5db128f1a94f1e162
MD5 ec6b58d5195da92128d2f19d675b38b2
SHA1 2121e8186268704ef341dd9843ad4c3067ef103f
SHA512 6c82103a642199eb1fb36706af3b005c1b3c6105476acf53dc37d1017cb512d5c1ec92b6278de836eeea7da8c62ca592cb5a676de291e810fe85e7cdf8e7debd
SSDEEP 768:lrv+4UNbdp38mUaDTd+Z+RCKeX6+qTko0u229a4vsTRqN:lbsbr3j+tvVTVKa4UqN
TLSH
T1A603CF32F8659D778DE6D2C4B10771472F7811638AC81BA8D9DD7F8D028B5AC270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download