hxxps://archive[.]org/download/edgetmp[.]-1243450383/EDGEtmp[.]1243450383[.]tmp

Resubmissions

09/08/2026, 07:23

260809-h73bbshd473

22/07/2026, 21:57

260722-1t7yrswaja8

22/07/2026, 21:26

260722-z97ghahl9v10

Analysis

user interaction
yes
max time kernel
45s
max time network
46s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://archive.org/download/edgetmp.-1243450383/EDGEtmp.1243450383.tmp
Sample260809-h73bbshd47

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3532	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307338227373272"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{0AB64A72-C05D-4076-B5C0-910F10B3DA10}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 2872	4412	msedge.exe	80
PID 4412 wrote to memory of 3532	4412	msedge.exe	81
PID 4412 wrote to memory of 3596	4412	msedge.exe	84
PID 4412 wrote to memory of 3596	4412	msedge.exe	84
PID 4412 wrote to memory of 3268	4412	msedge.exe	82
PID 4412 wrote to memory of 3268	4412	msedge.exe	82
PID 4412 wrote to memory of 3268	4412	msedge.exe	82
PID 4412 wrote to memory of 2732	4412	msedge.exe	85
PID 4412 wrote to memory of 2732	4412	msedge.exe	85
PID 4412 wrote to memory of 2732	4412	msedge.exe	85
PID 4412 wrote to memory of 3032	4412	msedge.exe	86
PID 4412 wrote to memory of 3032	4412	msedge.exe	86
PID 4412 wrote to memory of 3032	4412	msedge.exe	86
PID 4412 wrote to memory of 3720	4412	msedge.exe	87
PID 4412 wrote to memory of 4032	4412	msedge.exe	88
PID 4412 wrote to memory of 3720	4412	msedge.exe	87
PID 4412 wrote to memory of 3720	4412	msedge.exe	87
PID 4412 wrote to memory of 848	4412	msedge.exe	89
PID 4412 wrote to memory of 4032	4412	msedge.exe	88
PID 4412 wrote to memory of 4032	4412	msedge.exe	88
PID 4412 wrote to memory of 3256	4412	msedge.exe	90
PID 4412 wrote to memory of 848	4412	msedge.exe	89
PID 4412 wrote to memory of 848	4412	msedge.exe	89
PID 4412 wrote to memory of 3256	4412	msedge.exe	90
PID 4412 wrote to memory of 3256	4412	msedge.exe	90
PID 4412 wrote to memory of 4876	4412	msedge.exe	93
PID 4412 wrote to memory of 3644	4412	msedge.exe	94
PID 4412 wrote to memory of 4876	4412	msedge.exe	93
PID 4412 wrote to memory of 3644	4412	msedge.exe	94
PID 4412 wrote to memory of 4824	4412	msedge.exe	96
PID 4412 wrote to memory of 2544	4412	msedge.exe	97
PID 2544 wrote to memory of 2044	2544	msedge.exe	98
PID 4412 wrote to memory of 3220	4412	msedge.exe	99
PID 4412 wrote to memory of 3220	4412	msedge.exe	99
PID 4412 wrote to memory of 4320	4412	msedge.exe	100
PID 4412 wrote to memory of 4320	4412	msedge.exe	100
PID 4412 wrote to memory of 4320	4412	msedge.exe	100
PID 4412 wrote to memory of 3800	4412	msedge.exe	103
PID 4412 wrote to memory of 3800	4412	msedge.exe	103
PID 4412 wrote to memory of 3800	4412	msedge.exe	103
PID 4412 wrote to memory of 3000	4412	msedge.exe	104
PID 4412 wrote to memory of 3496	4412	msedge.exe	105
PID 4412 wrote to memory of 4408	4412	msedge.exe	106
PID 4412 wrote to memory of 776	4412	msedge.exe	107
PID 4412 wrote to memory of 776	4412	msedge.exe	107
PID 4412 wrote to memory of 584	4412	msedge.exe	108
PID 4412 wrote to memory of 584	4412	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://archive.org/download/edgetmp.-1243450383/EDGEtmp.1243450383.tmp
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffd553ec188,0x7ffd553ec194,0x7ffd553ec1a0
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,17513689722033349594,5508417234304093033,524288 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,14906451949802246371,16732310925860690647,262144 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,6895921123893078642,3899395927914608131,524288 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:13
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,9078904648808683574,11391217785973734854,2097152 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,15420206211885385471,17899104336969125553,2097152 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,8099293073103719912,14872653309163857929,2097152 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,10539104933790773905,14908201585268560285,2097152 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:9
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4200,i,18436985900674330001,12017832328374853850,2097152 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4324,i,18297592860620828365,8285964627996048413,2097152 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:9
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,6516969764101390023,15388088238040714122,524288 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,7101401267858617646,13005567927107233841,524288 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,13541594531439962150,11169818916724345610,524288 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,13541594531439962150,11169818916724345610,524288 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,7884958440971912877,3513128884706421480,524288 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1104
    3⤵
    PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,15975686633034641595,3279114116825788149,524288 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4220,i,4157947207072553033,9862268583912617751,2097152 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4132,i,9460542933642682164,15681728357558504253,2097152 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,1522109549870502606,6246694352701058910,524288 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,7101366850809127046,16737876650301263368,524288 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,267030080058409219,2238616617635689798,524288 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2964,i,3982647560360500798,12834839139248853622,524288 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,12738508731299485144,9558038602513283709,524288 --field-trial-handle=2192,i,17332039275598686871,5902486380395293333,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
  2⤵
  PID:584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2bd7e2a5717e219eda7d64538cf8cbc720ccd417e63c1e9b56a0e7f42dec19ae
MD5 f9b984742a3385d1d1f358d5f5b1313a
SHA1 e25983e9bfa4449e535401e4bc61380444dc2d53
SHA512 dc287abf634ad5661f2bdf00fdc623e1bfd58b95b3e724b374b2cec9d53d49674820dfeba2402935a5d4bf81a73490a9c862ec138a6fd62d6dbb7510adcca8ce
SSDEEP 48:tC5NFUiWUfkjDXNQVzXtQaov4zrjrhyKyZ72yYD1nLRfX0iE9N+VC:cdfkjDuVXgaXrhyKyZXYZRfX0/+w
TLSH
T1C5A15D509227CB4BFF4E1571A2F08717F47281B6B51B3EA6E658CDF056867C5CABC082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e52b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e52b.TMP
Size 3KB
SHA256 65a52f766872fdb53b750aa6ea89f496f1d1ec7b60c9a849ab867398bee1bea1
MD5 cde32886853d8b4d072b495139895e7a
SHA1 693e099952421f8785c627be56749ea7c87f48a4
SHA512 ffef834577f511ee04228d680cd68ab4827ef36a490123c2a8e1bd0faee4ec87b05c4cfd344272e921c257cfded71f9d68a0cb550e74cb72705596614552bc1c
TLSH
T16F616E554322CB8BFF931170B4F1C2077572C239FA1B3E6536688C746B82B14C8EA445
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 369f4ecda55c72588f861c828a0ff31b62e3910b3b03da6ec0040d50d742383e
MD5 88b724c756b0339b374d41e610e161dd
SHA1 272097985ab3e6c4aa5bced749a72c2dda5a9504
SHA512 24954c59ce9575f17a04db922f11a9979005dedec56c5e7f88d70ce18774d28930966003eee9637ee0a434f6f0a2feb73fddca016a8e869912ccae1b6fd11080
TLSH
T1FDD02223224031F9E56D3E9681AAAC8FD32790201882DEEA19D0989D053B56C8507381
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58c53f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58c53f.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cdf3bc4b5c0bdbfe31960ade0a9f6853f3d22eb2d73eef7258e75813d69a7473
MD5 0027bba16858c26b43bbc047c165d976
SHA1 3cc94a814c08fbc77d781971c1b5f8131d043afd
SHA512 35d24461b5996bc123267333dd7b37b624db99ad8bc004fddd7f5d7e6af545a347b5c19ec8d27e72b3bc41f171f318249175b92911ccea68bc8448dbd55c40c0
SSDEEP 192:sxZ9RGyM/jK1Ml8MFb/fLsHL1IVIdpM/W6+WNGY0uBH8YkFqdIgrJ:sxZ9Mdb/fLsHL1ImM/bG5usqB9
TLSH
T1564209016B346977CCDBD209F945BF93D6F91473A2900E58A9FCDA1C04E2AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8a16d38f6c32193f26d322c9a3d1e4dad15be1f4e512ab72f61f62b736c10533
MD5 e7e428d430918f08264b82da4a2e4b6c
SHA1 b8e91398260006c6fb2649a177ca071db9daffe6
SHA512 202b2b2de68abab828f86861826c637947f308367d87073306bf9873993ca01b5163f921dad32be38456a7e89b3d4df69db09bdb9c620aa012059c685a3fe2f2
SSDEEP 192:sxZ9RGyM/jK1Ml8M5cB1b/fLs5q5Iadp8wB/W6+WNiml/Y0uBHhUkFqdIg5cnSIZ:sxZ9MBm1b/fLs5q5IqZ/b1/5urqB5cZN
TLSH
T1D962F851A6249977CCDBD208B9247F53D6F904739A514E4C9AFCDA1C00EBAFD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a294cdc588108b4ae59ac582de5a364027b41be8c7595478f4127cf3d261288d
MD5 6dfbf8dcdd184e18eaea61eade5f269a
SHA1 23bdebcec4add598b2a9198c0fa79e20ba263709
SHA512 8490625ac3b42ede336847e6be062cfac8be6d6eecb0a96d0d8796204a0ff44118b80923013495f0931f72519bee43f0b6ad7b1979b5e8c829b0c05a9d378ff3
SSDEEP 192:sxZ9RGyM/jK1Ml8M5cB1b/fLs5L5Iadp8wB/W6+WNiml/Y0uBHgYkFqdIg52nSIZ:sxZ9MBm1b/fLs5L5IqZ/b1/5u4qBPcZN
TLSH
T13762F856A6249977CCDBC208B964BF53C6F90463DA514E9C9AFCD91C00EA6FD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 fb4466e912d346c1ce7ce0dc3e3de38c05970edcb737ef207e65ec63eff109de
MD5 ba06e8d44ae8bc4de62e4fa32724dad1
SHA1 47a421ca35e9a58a53594a2e8b375439ce568d81
SHA512 321bc90a99f18869c866c05df0731f0473e6d00fe389deb40ccf3259927fc35c422f067c9e56990226003d3b3a7a6daaa9db7b0f4abb455d464dbb4f772a147e
SSDEEP 768:cD/Lh8dF2/kWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KjLl/060l/3rozO:cD/Lh8dF2/kWRmAcQ3wu1jaKKjLp0Dlz
TLSH
T1B4E23A3B694CCB7E4F840EACEC266F976ED801CB56984D5447EA894C03C73EE411A59F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b82f5a3ae944d66cadd75aec782205ac342c9a9ca10f24a64e97fa89209f5354
MD5 d9c9c257fb97e698eb2c5b9ec3956b36
SHA1 b33598407b7fc0f90a98c3800e7524850c915119
SHA512 71431c5c2d94a68c35091cda1f10bf9aeefcb740caa64ecaa9fcfdd67c914cac1e403feedf1ac669acab3081241356b16e5e4e9c9b215ee63e1eb0532bff2717
SSDEEP 48:K08I/KFGsfyIfK/qkvypKIPKjaofytHI5KIIMS:K08gKFGiyoK/qW6KUKjaCGH2KIId
TLSH
T177B12553357A12033D3E285C969597A74B5671A33018B43F7BA818B60E6FE214DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 bd59317321576b078baab73d3bb603f8f6417c62b04dfdf87c6f9ca5f242c1ee
MD5 124111addaf6efe5b516e954b34764a2
SHA1 ead70c695b52abdbd68c7f85a09e2a6cc340622a
SHA512 9587a2ded44f5e7e418bf88d82dd195917022e48b703ea4edaeb22bf8383baf123ed0b681cacbc55c3914843d9f1fd6b6f083fd30da91f98faf4346b7a1ec836
SSDEEP 192:XXL8NvbQQep940HkvQmiU1hl040F2oP13jIT2pWmiq5U8:X78NvbvI40HQ5L0Fpt3jIT9yU8
TLSH
T11032093658385C775EF2A994F1473A13AEB4412BA7C47F9896EC5B1C04DF39C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 98cbec2ab2625acda4e8a90039903448a68a37f14eb4e0ef6f6b02565defb883
MD5 7a7a6e294469719d8098ecaaa4ad2067
SHA1 523cbe35ae68c9631e98915a5865e6dbf6567176
SHA512 0ad7d76fb6d6f14ae2592d01a6089125749454d901a35209df3793eb24e27eaa3781a8e4edd62f7d7a90ef8a569740c78db41ac83f72278606a484a2ad00ebb1
SSDEEP 384:70ZcIh8NvUDvI40HtqL0Fpt3jIT9ynTKwBODNZOCG5vp:+hPuMAbVjIxynewBKZOJvp
TLSH
T1EE927C725C3C2C77AEE2B949F5473A175DF49167B3C42B5896ECAB1C00EA298130BD36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8730c16865d08bdeef01401b14a826f0a8aed0335e3de72b0871ec3f54fe3a29
MD5 0433a6f29adedda58ca6e6a432fdbec7
SHA1 bf05f063cc2b7eff797aee238cea176a4dec6d17
SHA512 49514c7789e07c9254544ae15a7aec2fe8bb367fac598f654d138478a6764409754fcc74c282315e9b49056e3b179475ac3854d96a47c2d447bfbc5e711074f2
SSDEEP 192:qGNq6d9402QmiUyCvYTBF2oP13j2GwcriU6:qGNq6740SZQTBFpt3jEXU6
TLSH
T166020A3568782CBB9EB36E45F4473B176EE5112FA6C42B84D9E81B1C00DB38C2307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 251fee884fb338e1822f9f1949fad93f0690d5b40f9bcf815d3d431d76174557
MD5 053cf784b228ee3cacaec98b812c08d7
SHA1 fe0c93ebb537e0df4cc22d8948dc2cbb6808330f
SHA512 50a7c28e2cbfb8a112f7694f045b5d5d5251dd43766bd658f5ced21c00c9269246a8c1270691734ec72f2d1b38bff4e46a7874033a1c8971495ec4aaf7075c1b
SSDEEP 384:w0ZcIh8Nv9DvI40HtqL0Fpt3jIT9ynTKwBODNZOCG5vp:DhAuMAbVjIxynewBKZOJvp
TLSH
T1DF927D725C3C2C77AEE2B949F5473A175DF49167B3C42B5896ECAB1C00EA298130BD36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ac8fe530f47c13ea5e5248c517fad08ca9c8c426bf506724fdca5a6a1d10bcb3
MD5 01c78689525da6250973007840087123
SHA1 a45a7c7c35b4dbf19abbef16062135902e19456f
SHA512 5d5b7c160b5268cf7584036cab14fc6520f8fcf3a3a0baec79929c59a90d7e97999d1684254764135f5846f50c17ed8bf74c007516e96d3d5db52047f6b55e6d
SSDEEP 192:yGNK6d940CQmiUynYJBF2oP13jITTiDmiq5U6:yGNK6740+9JBFpt3jIT+yU6
TLSH
T12E122B3658786C6B5EE36D94F0833A136DE5822BE7C47B84D5DC2B1C41EF29C230B966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads