hxxps://www[.]flycharts[.]app/

Analysis

user interaction
yes
max time kernel
347s
max time network
350s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.flycharts.app/
Sample260815-kk2sdstsas

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3684	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312568701035381"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{771B7CD4-8455-4C6F-81BF-4046BE8273A9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 4080	1416	msedge.exe	90
PID 1416 wrote to memory of 3684	1416	msedge.exe	92
PID 1416 wrote to memory of 4132	1416	msedge.exe	91
PID 1416 wrote to memory of 856	1416	msedge.exe	93
PID 1416 wrote to memory of 4132	1416	msedge.exe	91
PID 1416 wrote to memory of 4132	1416	msedge.exe	91
PID 1416 wrote to memory of 856	1416	msedge.exe	93
PID 1416 wrote to memory of 948	1416	msedge.exe	95
PID 1416 wrote to memory of 2892	1416	msedge.exe	96
PID 1416 wrote to memory of 948	1416	msedge.exe	95
PID 1416 wrote to memory of 948	1416	msedge.exe	95
PID 1416 wrote to memory of 2892	1416	msedge.exe	96
PID 1416 wrote to memory of 2892	1416	msedge.exe	96
PID 1416 wrote to memory of 4616	1416	msedge.exe	97
PID 1416 wrote to memory of 4420	1416	msedge.exe	98
PID 1416 wrote to memory of 4616	1416	msedge.exe	97
PID 1416 wrote to memory of 4616	1416	msedge.exe	97
PID 1416 wrote to memory of 4420	1416	msedge.exe	98
PID 1416 wrote to memory of 4420	1416	msedge.exe	98
PID 1416 wrote to memory of 5540	1416	msedge.exe	100
PID 1416 wrote to memory of 4580	1416	msedge.exe	101
PID 1416 wrote to memory of 5540	1416	msedge.exe	100
PID 1416 wrote to memory of 4580	1416	msedge.exe	101
PID 1416 wrote to memory of 2912	1416	msedge.exe	103
PID 1416 wrote to memory of 2436	1416	msedge.exe	108
PID 1416 wrote to memory of 5416	1416	msedge.exe	109
PID 1416 wrote to memory of 1136	1416	msedge.exe	110
PID 1416 wrote to memory of 1708	1416	msedge.exe	111
PID 1416 wrote to memory of 1708	1416	msedge.exe	111
PID 1416 wrote to memory of 3544	1416	msedge.exe	113
PID 1416 wrote to memory of 2512	1416	msedge.exe	114
PID 1416 wrote to memory of 2512	1416	msedge.exe	114
PID 1416 wrote to memory of 2164	1416	msedge.exe	115
PID 1416 wrote to memory of 2164	1416	msedge.exe	115
PID 1416 wrote to memory of 1276	1416	msedge.exe	116
PID 1416 wrote to memory of 1276	1416	msedge.exe	116
PID 1416 wrote to memory of 264	1416	msedge.exe	117
PID 1416 wrote to memory of 264	1416	msedge.exe	117
PID 1416 wrote to memory of 5828	1416	msedge.exe	118
PID 1416 wrote to memory of 5828	1416	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.flycharts.app/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ff98c1ec188,0x7ff98c1ec194,0x7ff98c1ec1a0
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,17691959327925750709,18218362660578629387,262144 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,13698537000433189698,18198520060516308960,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,9713931370874414032,7419605749748099156,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,6442196070943731216,8721465662903426478,2097152 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,7301475332073622854,8093022789311783682,2097152 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3900,i,3003110718449518771,15626226967636792149,2097152 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3948,i,18106014523025213540,10312209738382507692,2097152 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:9
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,492616951478522262,4354535031778158052,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:14
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,15141618039217644877,7486925691200978013,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:14
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,8497963963270134901,2149248752345237189,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,8497963963270134901,2149248752345237189,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4104,i,4496576745040352770,11208602951938475192,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:14
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,5032859186441291645,17497469820640489820,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,8555273548744267064,9569157971918346836,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,16534755116721974403,18287691816467903025,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6508,i,5484070538162827539,11991935335053983880,262144 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,8460556076742207165,14296431163603702309,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:14
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,10261507386688087860,8467164236683715103,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,1239306876824830094,9077983218898951605,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,12476797352253413083,17592642344198315206,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,2175556167962186373,7533054582999527752,524288 --field-trial-handle=2512,i,5170491967605068864,3617729925391267495,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:5828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5f97b8a2c4ec044d5e1408cd29238b9c30eeac4bbbf68dbb596b953d823efa85
MD5 defdc9a543e0e656af2f8507d184a1f9
SHA1 d4d76a1e155c7aeaeb2b8008a91b78eb80b31590
SHA512 fd39865ad64200106a7b0f8c7c11f5ef80d363fef2b72e9373dd46fcc9b232afeb87566d6dd53ec63e9a7876ce2c50912f72d03168dccd1630366600c88e0ce3
TLSH
T17DE020A409DDC3DDFD51648751B5574D82803B8B97C4BA053F418B497143880F6E3551
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 afa5f796d8eda4d89a55ad362f7847069e4e9ce1987c3cb1484168aaaa7ba6b7
MD5 48c5a36e659098edb1a4f26e4353deca
SHA1 823d3fe594cb5e8a9cd77b1c72cf40077a051b18
SHA512 54574f9c3891cc3f40d5e2cd890fef9c517ef8d30bcd9b408db7debfe00dd7c58f4a392756fd4dd1b1547261411c7721bc691aa1117e538f7a96af3832562774
TLSH
T180E026B896CCC26EEA40E48B51B8634DCA817B8F93CCB99A2750CD897042440BAC3791
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e1dad5e23253ab09f8bfab63d068de67440eef8a15aabac24e3efe50ef522960
MD5 ffd49339936be46397d2b1d73d59cf09
SHA1 e002fd397af06d55957a63664a6c38f065a13dc8
SHA512 3cfa5b548c0921f72a3d3282f1b0fe9bc894cff6d5bef75abf4f567a77b0b39b03c2b94ca7b2586b15038462ce7edc9e6be7e68605950c6a75dfbf593fa34f7b
TLSH
T1C961A6764BF2869AD766873918EB9FB831F4F8464547AE0184746D3CCB07F2A5CE101B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f8ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f8ae.TMP
Size 3KB
SHA256 2ad0c2971311989e5d75c4780eddd18dac4432a67e11aac81ab838e53aaec19b
MD5 0adc9507b14d7fb701aa4288ff626c6f
SHA1 949295a56a59fdced753c0db38e5d6cb02359b0f
SHA512 215fd5038b83710317d0307849c6d734a6a4f349a07e699d2c7a988f76737896421d436fd943a70fc312f424ca7cbc0613611fe1bf32a00142363ecf1ff6df8b
TLSH
T12C6187760BF286DAD766873A18EB9FB431F4F8464447AD0184645D3CCB07F2A5CE101B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 07cda2bdf982c68f49077b056e0c6f6445428efe31193f8712ee073f455746b5
MD5 77aef9532cd88f053cb8cc0fc13d0f7b
SHA1 db314755593244fb9cdff652e1487f8a38542073
SHA512 2144bf1f58ff701cd31ecf4e0ba11b66fc42b59baafb816481c41caca796cd8204327849641ecb32ae44114bf9a682ad13d95ab07789aca9db377378a4dc2592
TLSH
T12F518DF783B4956ECA1196F0BA146F1FCE1D0526436C7C6A89E09E2797E3472E041A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e9b8925f995b70f1c6d45cce8dbc2c3eddc0f5eec75b78dbd0171b1fe8bd5a01
MD5 939a92f3c41a1605736ea4c8974dc669
SHA1 345a1a85a49e836db2afa7a44b26e2d0978c5f83
SHA512 f8c26a435dd914fbbb423006799efe3c464dc7c5b28a5ac8d3e43d7fc664e9be30604d2014a0da3d0cc25cdbefc1925d031ae00b672cb5c8aefe400f900cfd63
SSDEEP 192:sxRQRIyM/jK1Ml8wb//fUEsurJCKrjDdzoA8p3q/g6+WNW7g/YEMeiKl+GA0IgIJ:sxRQel//fTsuoTa/5J/Sga4s
TLSH
T15D62F9156A249D7BCCDBD20DFA55BF53D6F81563A2901E44AAFC9A0C00E7AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 95e4b5995f149915dc4755ec561b7ee67c8a2e430ece67b85eca6d03082213be
MD5 d5cf00ddc301a9796209605e985c9d04
SHA1 7fa82ffc6f1fb3f27599e67572a495de161fb6e9
SHA512 7b9a58b1e82279018d88afe406ba1b75f60e943152cf3680654b9553a6a17e7d23f4b3a77a057140021617e2e53df3332e9b7e8a6701230437933b1a009071b6
SSDEEP 192:sxRvRIyM/jK1Ml8wb//fUEs6rJCKrjDdzoA8p3q/g6+WNW7g/YEMeiKl+GA0IgD2:sxRvel//fTs6oTa/5J/Sga4K
TLSH
T11462E9156A249D7BCCDBD20DFA55BF53D6F81563A1901E446AFC9A0C00E7AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ca91c4660a96fc4bbfe80ab0fed0400005e0bbe5a49b8d630538145ba80b16cb
MD5 f110f1b82cec35b7658a2305aa1c5100
SHA1 85823a0636013464a29102c5ddf8551553063548
SHA512 d7658133436970ce98a6ecd85a80b12956014930d879311ddca67bcae374d47ee8beda15c59a7b92ca55c5dc89d14779e3967da412c4453931c8924eef23bc97
SSDEEP 192:sxRvRIyM/jK1Ml8UQbb//fUEs6r2mFCKrjDdzoA8pNq/g6+WNW7g/YERIiKl+GAL:sxRveq///fTs6SmATw/5J/7ga4I
TLSH
T11062E95569249E77CCDBE20DF955BF53D2F85563A1901E046AFC9B0C00E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 cd853dacc41994aff75fe7cd09ff2bb1036908d3e5bd7e56a1635609dd4c04ba
MD5 268d1eb2580ac04f9a594d108d8f7db2
SHA1 6033a34171beb8344b0923c9fac0e4bddf2683e9
SHA512 2b980edca14d035ceeb2d1fb4d5def624038e8950a0335f75183cdd13ecc18839f15231c2f308b8af99dfb4741112b72129cc11661e6ddb0cce6bb7d5054c901
SSDEEP 768:0hiiBaWgH7f3Q8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsOV8vroD6g:0hiiBaWgH7f3Qu1jaNI88d
TLSH
T107C21B3B240CCB7E4F805EACEC25AED66DD801CB9B984D9447EA884C03C77EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ea0d575b-3472-4b75-b3a7-02aecd4232f6\index-dir\the-real-index
Size 672B
SHA256 619b04ddfaf32490a29f556e655e69338d2a68f060877512616dec14a37e4b90
MD5 6f12ebabc23bab5a90e601c866ce7bb0
SHA1 7b33b575cc2d21526d05d30b2ebd8c6e78910340
SHA512 b20c4cfa7e6ad7243861b294cba2e0230eac0117011f518cba9bdd079abc82d0bc7f2250bdcfa42431a8d049c10c23d8b474c89f8bbbc613b7ccd96468263fd0
TLSH
T12F010E8B8CD1680BCC32657B2A39358D373800EC2306AD8B005C7035AD63634C684260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e2355.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ea0d575b-3472-4b75-b3a7-02aecd4232f6\index-dir\the-real-index~RFe5e2355.TMP
Size 672B
SHA256 9d3ba5d08fc6eb365132f46b91f2ba0d26ffd7d3368af122ceebd458291975c4
MD5 55c13865bf4d4ae927e2642ccfbc80eb
SHA1 506a4475308540a183ad9b08caae19b08a883906
SHA512 44cd67786ba25ba8d5dafaef61c9c3485f2fc8efd8f471aea3b18c63ea0affdacc88d818bd1903e0a3b9c186b46ecd44bb8007f033224c41f0e35714b1183345
TLSH
T19B01D4D700D1FC12DD5665B532566115733E0C302525D98F21E6747A492173481C1651
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9382ef45f2dc3c68fab4b88212b351cbe5d8aa925fa90cbc24834a135df03c4a
MD5 92a498eeaf212356d6151e1eed7445a0
SHA1 9fcf9581ca5b448c4162e8641ef7967cc9be6710
SHA512 e5dc754565368ba612d98800d64780a1fb2f175fd72dc457851dbd2a607af6bacc33fe4004db9b6291068bd6153fdeecd8d1abfea755ffc27eb3db01ed5f8ab5
TLSH
T1B1E0C0BB3DE71C60AC5FC7D6107491D0001839D48A45EC8E461EE3CB51733113806C73
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e918549d8db87754a282152584dd4d8726988df3432dfcebc4704611f39071fc
MD5 37298ea6e82488ab5423faa0df594aae
SHA1 797877397b57c376b2bc00191d6a2ebb7a9fe6ec
SHA512 d3a70a97b84dc65e7907081b43a0c6561ff3fd2811a116389ba983e9eb63ca97eb6cdab3d62249d5b6e2ff58269d30b9b6404db8fe1bca2dd9747484d2768a20
SSDEEP 768:T1rv+4UNbdZ3NqGmMDlK48dHeByERRFzjK3Y5co6w:T1bsbj3YGts48dHSyw/PcoH
TLSH
T13703BE70A8A8AD774CA7D289B2477657BFF0425381C81B64C5DDBB8E41CA4EC170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b414d32e2cd25880ed4b26f3277fa93b5bf9adfff4408c994c88e2d34effcd14
MD5 8601556a36de494176719219fbcbead8
SHA1 6b79c79d4b57083c6cdf86b737977af0f938c1b8
SHA512 5661d39d0e2230b9009b8a21641a876cca66620354485f049701a767c35def49df00a8838440da658c8bd61259a15b1c2bae545d9a3bd62e7601c95a80c8b003
SSDEEP 768:RrS3PqGOMD4K48dHeByERRFzjK3Y5cPi9P0:RrS3iGFV48dHSyw/PcPn
TLSH
T14AF2BFB0A9A46D774CBBE289B6537757EEF04223D1C86B6495DCBB0E05C649C070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 f22034729217a5f093f9c69a6347c97c615dc7a820fdd909d65194b478cff2c5
MD5 29606728ea5a985272cac81dcfa73d20
SHA1 a09c1c1de9c31b69648dd46264dbeabad9204913
SHA512 198e261e7cd24a4d00bceee18cbc7436f8190dacf0679f76c3f1bd4d85508886ab0e44af9b1230d692a717c622e4ed15942554f2ebf03fc828b477144931d136
SSDEEP 768:JC03PqGjMDoK48dHeByERRFzjK3Y5cPi9P0:JC03iGYF48dHSyw/PcPn
TLSH
T11F136BF054E75972CCAE9347637E2E06AEBCC213B1845A54B7D8A60DCD864BFC70781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2fd9155f333ce176f57efa698baf4c32d33f8e23d4f880a328bd3bd1bd9c74e8
MD5 b85fc11d297beb71d6a4d2d9f9437257
SHA1 3fbe655b21f2082fce8eca88ad0442cc95e34841
SHA512 8730074e47f32ec86be4d16669eee332fa6a96354f7ee4961e8fef69bf99672c37e93777b4f4d2d383b1198fe9b4f4f99de4b8ec94b4e70054ee10221f7e45ea
SSDEEP 768:Qrv+4UNbdf3fqGL/DxK48dHeByERRFzjK3YTeVH1SCj:QbsbJ3SGP448dHSyw/hEH1Z
TLSH
T16103BE71A8A85E774CE792897683B65BBFF4411382C41BA4C4DD6F4E828B4DC130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e496093d0738ef09f14577209f9cb1ac8e0fb32f2963398670911821c2a504df
MD5 22e7706ad9ed19ab9fca54ecbbecf745
SHA1 ca0decc27ca60ff7e463a1de8a41f8b4ef7e6a62
SHA512 8cc5b0bb32d5f551719d15ea0518b61ce3916c47f00ef9e94dfb6c2fd0632ed85ef1952d6a46bed50a565bbf50fb027b6611a9fa8157ed42ef6fa360bf80fb91
SSDEEP 768:drv+4UNbdf3OqGK2DqK48dHeByERRFzjK3J5ceVH1SCj:dbsbJ33Gnj48dHSyw/+cEH1Z
TLSH
T1A803BF71A8A89A774CE7D289B143B657BFF4421382C41BA4D4CD6F4E46CA0DC070BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18792384-f70c-493f-a199-41fb1f30de6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\18792384-f70c-493f-a199-41fb1f30de6a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download