hxxp://pparesearch[.]org

Resubmissions

09/08/2026, 18:11

260809-ws1qvatajb3

09/08/2026, 17:55

260809-whq4nasgra3

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
299s
max time network
287s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://pparesearch.org
Sample260809-whq4nasgra

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4344	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307717477439191"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{4E983E8B-76FD-42FF-9C4F-CA561FE330E6}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1028	5036	msedge.exe	86
PID 5036 wrote to memory of 4344	5036	msedge.exe	87
PID 5036 wrote to memory of 536	5036	msedge.exe	88
PID 5036 wrote to memory of 536	5036	msedge.exe	88
PID 5036 wrote to memory of 536	5036	msedge.exe	88
PID 5036 wrote to memory of 1812	5036	msedge.exe	89
PID 5036 wrote to memory of 1812	5036	msedge.exe	89
PID 5036 wrote to memory of 3336	5036	msedge.exe	91
PID 5036 wrote to memory of 3336	5036	msedge.exe	91
PID 5036 wrote to memory of 2148	5036	msedge.exe	92
PID 5036 wrote to memory of 3336	5036	msedge.exe	91
PID 5036 wrote to memory of 2148	5036	msedge.exe	92
PID 5036 wrote to memory of 2148	5036	msedge.exe	92
PID 5036 wrote to memory of 1772	5036	msedge.exe	93
PID 5036 wrote to memory of 2740	5036	msedge.exe	94
PID 5036 wrote to memory of 1772	5036	msedge.exe	93
PID 5036 wrote to memory of 1772	5036	msedge.exe	93
PID 5036 wrote to memory of 2740	5036	msedge.exe	94
PID 5036 wrote to memory of 2740	5036	msedge.exe	94
PID 5036 wrote to memory of 4712	5036	msedge.exe	99
PID 5036 wrote to memory of 4712	5036	msedge.exe	99
PID 5036 wrote to memory of 4712	5036	msedge.exe	99
PID 5036 wrote to memory of 2152	5036	msedge.exe	100
PID 5036 wrote to memory of 3252	5036	msedge.exe	101
PID 5036 wrote to memory of 2152	5036	msedge.exe	100
PID 5036 wrote to memory of 3252	5036	msedge.exe	101
PID 5036 wrote to memory of 632	5036	msedge.exe	103
PID 5036 wrote to memory of 1048	5036	msedge.exe	114
PID 5036 wrote to memory of 632	5036	msedge.exe	115
PID 5036 wrote to memory of 440	5036	msedge.exe	116
PID 5036 wrote to memory of 3696	5036	msedge.exe	118
PID 5036 wrote to memory of 3696	5036	msedge.exe	118
PID 5036 wrote to memory of 3404	5036	msedge.exe	119
PID 5036 wrote to memory of 2232	5036	msedge.exe	120
PID 5036 wrote to memory of 2232	5036	msedge.exe	120
PID 5036 wrote to memory of 1504	5036	msedge.exe	121
PID 5036 wrote to memory of 1504	5036	msedge.exe	121
PID 5036 wrote to memory of 1168	5036	msedge.exe	122
PID 5036 wrote to memory of 1168	5036	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://pparesearch.org
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffd9b3ac188,0x7ffd9b3ac194,0x7ffd9b3ac1a0
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,16660130821192624643,9866988831617991322,524288 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,2405000702406098232,14911365212848458699,262144 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,9960252078570330831,16329273542682065099,524288 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,6946215794003407954,5169769276897635474,2097152 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,9378883525883989540,11119990868490273959,2097152 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,3247182810522748809,2699594071263588047,2097152 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,13148401501435755678,4401389952176118728,2097152 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5104,i,3220591833471418507,4438858883930813638,2097152 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,11579210924589269573,5574172446649238815,524288 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,2481792374668525677,10770554766100621389,524288 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,10034971330910337043,3125804763250408180,524288 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,10034971330910337043,3125804763250408180,524288 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,1718704828702625276,60811463481621371,524288 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,8476669646117932337,8966120096694007288,524288 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,2388455882669824754,10853908480133695810,524288 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,14903489708428014850,7512379012850998401,524288 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,10028083601382206850,11585714012604028980,262144 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,5458813390187897709,5684759567702895683,524288 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,3667002565214559774,12584963177119673472,524288 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,12846388906982758128,3204254948353580903,524288 --field-trial-handle=2124,i,7890780390393348547,8780747247647143479,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a1e120816868b78da2b01e67e245451ef89202d5ed252a52598da366586e3631
MD5 24b3efa19518d215c4d78eab22ddbee1
SHA1 40578aa1061f1566355f9e51562542e5f0f440d1
SHA512 ac5e74c2abc93e28576c4b699ba94f86290119e088a2f4248de3b9b85fe193f6ea9142ea0f620a8b15550df214dcc1c0fb9535f1b15e708a67e94a66224f6264
SSDEEP 48:kR28B3+rmPVUIWzftsSD/lnK2sxfu8a/KY9wz7Fyyv6XNotiCKQYMsHVgMuy:kRDB3+UrQ/PsxWGyyvyNorYNHVgMJ
TLSH
T1C981E63A019106B2FB6441B357C229C5B8B4B7FBF963FE4392986DB80F267C0C547284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 faa11e76dcaaecf17ecd4352df0e8031ad03c8ffe83ae1ecb78a132b0c3ce358
MD5 812b47028d60c1b07e04acac56371382
SHA1 faf4009ea39728b4599ba9b7fe5d5fc202b38d8b
SHA512 39dc6f7bba7461d573b7b13e68e56631e67f79b79df0794ca4b42ac818c4365a8599879e2cb9d3492fe4ca32c48ed93ad27674140c489fd2f032a25be260c4fb
TLSH
T14B81ADB6D2D8CD6EC91611F19A667E1BCD490918822C3F97CAD5EF4BA3E24B1D20094F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 60896e283faeba6411f9accf6136a79f12486424725f9b18649d16d1ba798b8d
MD5 97484885a91c796374fb1fc94a1b1b07
SHA1 e467944ff26af1e4ba48aefc83629b6cc9e22094
SHA512 688d056ffee8b66007f013465c597ab79b59ac82e5fa982f3eeaca4f569c418e0eaf0b604be704a270858312a12ae42406c2a976292b8acace461835371193f2
SSDEEP 192:sxZHRskX/f3sbJdKIdpR4HW6+WN29a/YzBZMUIgrJ:sxZHVX/f3sbJBeHbZ/+9
TLSH
T13422C7526E38A97B8CCBD20DBA15BF13E6F9503291941E58EAFC961C05E7BDD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5232fe7806986c33b80e274210e809a5411a67ff5756701591f6ed36a59ed4dd
MD5 9a42bd7a33e994940a2b2c87b9a44787
SHA1 681324a0fb07c7a5f5bee96ca00b65a15f890dbc
SHA512 51d8b798c3e272b175d6b25e198b3291e00e744affd333da08121f3114b674bcbb0d1bdc81a8b13d5f84e74d51104be4a7809d1a6b73594b5d20c40542f6e930
SSDEEP 192:sxZHRskX/f3sWhdKIdpR4HW6+WN275XYz4jMUIg5EOJ:sxZHVX/f3sWhBeHb4Xd7
TLSH
T19932C7526E38A97B8CCBD20DBA15BF53E6F95032D1941E58E6FC961C05E7BCD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 74f750152bbe8ec3aaccbf33f62b20be86e3c96c0dcc3a1b18583202d5093757
MD5 d9dc9209ef4c4d08e1c4e095ba407188
SHA1 24d82cbfd715459dc1c7248add51abec06cacde5
SHA512 75529395af99a90e4f6b049f9d9ea24cd0bf5ddfabf94632b320bc833f6c7ae0a58e31e820fb905af3212a6d5dce2f7dfa804adce672847a5d9fac8c16217ca4
SSDEEP 192:sxZHRskX/f3sWJdKIdpR4HW6+WN275XYz/ZMUIg5EcJ:sxZHVX/f3sWJBeHb4X8V
TLSH
T10122B6526E38A97B8CCBD20DBA15BF53E6F9503291941E58E6FC961C05E7BCD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0f2ca7e6d69ffbf5ffe3ad037e8b7024a98dc6e23ceacff99d6a411014828aea
MD5 390d5d3d168f789baf2a167876b32291
SHA1 774913eb995a27a84dde0cb4f675334ee8ef15b4
SHA512 93c12b1f4abf7ceda8bf619d176a200c4fbd39f770b95dac92e4790de19708cebc3031f3d96e10c413d87527fab4351bb3dfa1362d335a856bcfcf4e8f3df5f4
SSDEEP 768:5hk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBKroyTYr:5hk7u70WvqiEau1jai5LA3Bhnr
TLSH
T11CC2EA3B740CCB7E4F801E9DAC566F973E9802D7A6988D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 866d27f17327ff97f0c49d1f2b237afaef9ef1d957fb7f03775d36951521f9e8
MD5 67077e3cc95c4ea41f62e5c696e45d43
SHA1 5c1a15ef6bd5ba721ce1193671487ef3504527e3
SHA512 be933afde9d39d89d34851312f5599213d547da10303e9e6d49f338c151eeaa1394b5ed0068aa80195784827beb9b82d9b6281d4c8f63bc9f109df8c5bc925b1
SSDEEP 96:KIbCKc3/WKQouWF8BVr/7gfH6z99gKV19jgxN9qDPD6Kk0eg:sSdWF8BVr/72H6B9J19juN9qD+Jg
TLSH
T156A16256303B06813CBE688C91A5852A8E4232633446B96F7FB804725E67E275FFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd6f075e-881a-47c4-8890-494c4e9dc25b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cd6f075e-881a-47c4-8890-494c4e9dc25b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6e436e20cd11ab6da6117657cd6f057d8fd33c02d81c367b2db3c9e3debafa78
MD5 c111447ac85941c3912ff7079d8e1945
SHA1 9a50f0daf5d66de2c294a03106d8d11fbb8ee478
SHA512 771ce0d8bc1ab864e9285d3e99dae4e689ddd33bac04307e74cefeea3e08e9ef6e5ac13548a09e08b2a4cf4cc29d9de36737fdc47f7872b66c45ab6e6b20995d
SSDEEP 384:lZcIhsNPAUsAbtb/O3Eddm1Q8sk/XEKqfPbQEiJflB3CJBu2:dhbutqUmQ8sk/XERPbQEixlcBu2
TLSH
T108929E325C35AC679DA6A149F48A36035FF8807BF7C46F80EADCAB1D01EA69C0306D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9ec830f307113137ef3b3e316f2484b831caa178aea852684e537c81fefb3b7d
MD5 2c03756e2836d12c7cccafcf4997ba2c
SHA1 417bf3b60841f03640da777476a74cfa183a1d42
SHA512 1fb6d892ae88f3dc9cf8e7c022f232f7fac42e82733a12de7bcb0a972c4f5c0c5a4ddd2126a6978bf3fafdfb7c162d2943b8b010126287d04a484c7cc12ef1a9
SSDEEP 384:uiFiZcINzsNx8TUNTUlIl9UsAbtb/d3Eddm1Q8xk/XEKqfPbQEiJflB3CJBu2:FFQ1wwgLutRUmQ8xk/XERPbQEixlcBu2
TLSH
T115D23AF248E7993AD9AE9747E77D2E035EBCC067B5845A40B7C89A0CCC961BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c535f9f6d0e0b8dabd29c96538aaed4343e3a6103472fff9ab5bd359da705012
MD5 41385fe3f96968cc7ca75524651732f8
SHA1 65be01614ad6750902a2ae1c62654c9748a53015
SHA512 fee61ccb86c796b60c7092d4cccb9085476d284d1ec54098879cf6c1dc63c41f3a942ffb95f68220e6a3d6e73b9a9636b4a45b7a26d9a038aed154f958388540
SSDEEP 384:DZcIhsNP9UsAbtb/O3Eddm1Q8sk/XEKqfPbQEiJflB3CJBu2:bhUutqUmQ8sk/XERPbQEixlcBu2
TLSH
T1C4929D725C35AD679DA7A149F48A36035FF8807BE7C46F40AAECAB1D01EA69C0306D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ee6f978fba82da0fe35ba3814575e9a40beddc34258f291c02f87a614b475c77
MD5 8093d26030e29852f39430da3dd832fc
SHA1 53e53984e213998f430f5177d8a489c373d1cec3
SHA512 7c8d01aac4a22ebf039818978563279f6661594e930747acf57a107e71e57c68281f2689c6f50845e6d7bd9cc6102010cc1d98c32b146c905ffaeb83ba03ec8a
SSDEEP 192:MONE64BAQmiUyH16W5GBPKrs+FdGGm1/aDUV9U6:MONE6eAQMWDddm18qU6
TLSH
T1B802FA38AC786C7B9EB2AE45F48737175FD8113BE6945B54EAE82B1C00D775C234282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 53de174095082f9ef7e286e808ab10fda197c6ab39a00b270f190e36f173eddb
MD5 6989203f1ad57e349e224534a9c3199f
SHA1 6b087d211c35befd0fba95b635b9371f455957c5
SHA512 f34ffb4385d6a7085812e68474c11e75cecff0def2da345ffa8a39f7e695ccc090fe718e7222099f9e84c176544f5a3a46c533fab0b0517c5e21fbcd1d22151e
SSDEEP 192:JON664B+QmiUyd6F5GBPKrs+FdGGm1pFE88WwMqCU6:JON66e6JFDddm1Q8SkU6
TLSH
T132121A35ACB4BC6B9E92B145F48737035EE4522BEA846F50E7DC6B1C01EF2AC2306817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e2f27f64ea3328ff4d555483b07b20e42cc4626ed8c35550db5a35eb8e81f67d
MD5 a35cea448386df0a41658ef5321ddc72
SHA1 56091ecb94b134f7704aa5eab43a9d2c45635f43
SHA512 366063143f97619064d84dabe6f825a4f9457b3cdb7937b9e6196421f3c368d4fabf121370dec27d5e3cfb5acfd6322e0ca0a479f1d1f0de6537e5a3d4f4bbd6
TLSH
T12341F898BAFD1144B3B7AF16ABF6686D087B7D372F06D45D10150D4E0A63A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download