hxxps://docs[.]google[.]com/presentation/d/e/2PACX-1vRxCHWORltisPC9EHX4lomvVUPLoPK-HKHUaxeH7ItP_BVpKL8-TKmoK3s2Fw-kURvjLa0tXwo5-2BV/pub?start=false&loop=false&delayms=3000

Resubmissions

25/08/2026, 18:41

260825-xb48dat1dx6

25/08/2026, 18:40

260825-xa85yat1by3

Analysis

user interaction
yes
max time kernel
53s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 18:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://docs.google.com/presentation/d/e/2PACX-1vRxCHWORltisPC9EHX4lomvVUPLoPK-HKHUaxeH7ItP_BVpKL8-TKmoK3s2Fw-kURvjLa0tXwo5-2BV/pub?start=false&loop=false&delayms=3000
Sample260825-xb48dat1dx

Score

6^/10

discovery motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 3 IoCs

phishing motw

flow	ioc	pid	Process
100	https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ifkv=ASSHykp2dAPLuBP5HegpyS1GAwz10dMrK_FdnrtCzVXrzXoVee7DuGeLUMokaAZZUcEpkw7hixwEkA&rip=1&sacu=1&service=mail&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-233362078%3A1741544750655901&ddm=1	3016	msedge.exe
100	https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=853637742&timestamp=1741544754294	3016	msedge.exe
100	https://accounts.google.com/_/bscframe	3016	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3016	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321569161738003"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{97493DDE-6449-4CD8-88AD-388F4079F636}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 3920	4928	msedge.exe	85
PID 4928 wrote to memory of 4608	4928	msedge.exe	88
PID 4928 wrote to memory of 3016	4928	msedge.exe	89
PID 4928 wrote to memory of 4608	4928	msedge.exe	88
PID 4928 wrote to memory of 4608	4928	msedge.exe	88
PID 4928 wrote to memory of 2088	4928	msedge.exe	90
PID 4928 wrote to memory of 2088	4928	msedge.exe	90
PID 4928 wrote to memory of 696	4928	msedge.exe	91
PID 4928 wrote to memory of 696	4928	msedge.exe	91
PID 4928 wrote to memory of 696	4928	msedge.exe	91
PID 4928 wrote to memory of 1900	4928	msedge.exe	92
PID 4928 wrote to memory of 1900	4928	msedge.exe	92
PID 4928 wrote to memory of 1900	4928	msedge.exe	92
PID 4928 wrote to memory of 2856	4928	msedge.exe	93
PID 4928 wrote to memory of 2856	4928	msedge.exe	93
PID 4928 wrote to memory of 2856	4928	msedge.exe	93
PID 4928 wrote to memory of 2944	4928	msedge.exe	94
PID 4928 wrote to memory of 2944	4928	msedge.exe	94
PID 4928 wrote to memory of 2944	4928	msedge.exe	94
PID 4928 wrote to memory of 4864	4928	msedge.exe	97
PID 4928 wrote to memory of 4864	4928	msedge.exe	97
PID 4928 wrote to memory of 4864	4928	msedge.exe	97
PID 4928 wrote to memory of 4584	4928	msedge.exe	99
PID 4928 wrote to memory of 4584	4928	msedge.exe	99
PID 4928 wrote to memory of 4584	4928	msedge.exe	99
PID 4928 wrote to memory of 1916	4928	msedge.exe	100
PID 4928 wrote to memory of 3632	4928	msedge.exe	101
PID 4928 wrote to memory of 1916	4928	msedge.exe	100
PID 4928 wrote to memory of 3632	4928	msedge.exe	101
PID 4928 wrote to memory of 1132	4928	msedge.exe	103
PID 4928 wrote to memory of 3952	4928	msedge.exe	108
PID 4928 wrote to memory of 3952	4928	msedge.exe	108
PID 4928 wrote to memory of 3952	4928	msedge.exe	108
PID 4928 wrote to memory of 1132	4928	msedge.exe	117
PID 4928 wrote to memory of 1132	4928	msedge.exe	117
PID 4928 wrote to memory of 1132	4928	msedge.exe	117
PID 4928 wrote to memory of 4160	4928	msedge.exe	119
PID 4928 wrote to memory of 2736	4928	msedge.exe	120
PID 4928 wrote to memory of 3844	4928	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/presentation/d/e/2PACX-1vRxCHWORltisPC9EHX4lomvVUPLoPK-HKHUaxeH7ItP_BVpKL8-TKmoK3s2Fw-kURvjLa0tXwo5-2BV/pub?start=false&loop=false&delayms=3000
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x24c,0x7ff8c83bc188,0x7ff8c83bc194,0x7ff8c83bc1a0
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,11836957999912056450,10774332940147571715,262144 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:2
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1932,i,11993664293470951963,17107398359631372816,524288 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:3
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - System Time Discovery
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2292,i,8901008978208950977,5892307595591704106,524288 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,14943900454355855333,453185561344332930,2097152 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,196770421932117790,12034268883489001114,2097152 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4108,i,5261903249197928487,695488562809104054,2097152 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,5981235660649750843,4199504012236693219,2097152 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3528,i,446556334873293069,3760831796553600123,2097152 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5204,i,13825416723712913640,13891275280828267111,2097152 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3712,i,452441401436537462,15131472199424566853,524288 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3716,i,6667950030592115471,1660122319491552081,524288 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5928,i,7950694657090378422,3458378592795421823,524288 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5928,i,7950694657090378422,3458378592795421823,524288 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6380,i,9204742204077473553,7531310186422729416,2097152 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5372,i,13662323664715126793,7348385126343308637,2097152 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4180,i,3215942481484270301,17269154349566153070,524288 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4396,i,15639568649260377203,7313259332563805413,524288 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4408,i,3938562673094529798,1179593409413131890,524288 --field-trial-handle=2804,i,6445385001470503064,853572445101407244,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4f16ff49fac56445c7e00020cb918023be78e50fe95780347a43297ac6053540
MD5 9b4e512d9bbb2dac4afc807915db7554
SHA1 af88806a55925520fd09c0aa729ddedf902a1f3d
SHA512 7e08752fb0c7bc867d85141749dc1c4163db996a33af55b851c42df818703f984834fe518205b7be7f7080cfeaf54cbd24faee75b2308b76434c9ce0945845a7
SSDEEP 192:sxZPRbyM/jK1Ml8Mkv/f2sC36Idp71HW6+WNfQP/Y4MhG+AIgrJ:sxZPVMv/f2sC3TJHb8/Jp9
TLSH
T1D852E9116A34AA7BCCDBD209FA557F53D6F40472A2910D48A9FCD91C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6e45061d212b3fae59488e2813fae257ddda7d427f244f903a9070db3817eb85
MD5 3f194bd8e203d141992e56864056b6f4
SHA1 cad5ee3fd3e12319c66df1c6b1100045bfc4b31b
SHA512 f092a36458d4a3c169612929fcb174258fa300a4554d3386d2632e6563d380014f489a159091a506efc559aeab46652b65e9f0cb22090c94e2cf533ddff27521
SSDEEP 96:KkOkKHK6TEPIkumW28mJ9Wk2K+TWi2yMERSFPGKcUCKz:S3TEPIkumWlmJkk0TWi5MERSMVS
TLSH
T1F791861231BF43013C7F681A95919E571B4275A3346EA82B3BA804B60EABE241DFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfbe6e7a-9fb7-4bef-a052-9602a816c308.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dfbe6e7a-9fb7-4bef-a052-9602a816c308.tmp
Size 30KB
SHA256 980a29e6d14777cddbb1639a68235cd7232843818d8c8db758493cedfbe91c4a
MD5 03d0dcc5b24fe981ea1a159b176ed126
SHA1 f60b3f976d4fb56e6d865eb964aefecb72a4413f
SHA512 dcbb17f4f64375d698b3adcf5032a65d56f9b25564a9ec3588513f8c474f3fc069f2641ec978b1552c4334ebfb8f9ac0cd79baf84978996ecac29d9bf05b3269
SSDEEP 768:oS8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opd/roVkdBUns:oS8iJPNWvx76ru1jahALocdsABUs
TLSH
T162D2FA3B680CCB7E4F845E9CEC266F966DD801CB5B948D5447FA880C03C76EE512699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 54081595267d2833efff254a62a6b2abc585ddfc8e34c479a728c8c2c7f2a125
MD5 8323d494cc87ea2057684b7c048a31ca
SHA1 60a83eab1d485619d8faf49a7e8860a77545d2ce
SHA512 42b17abf1c17f0fa656d775b27a0c0439c0d1aa4b61a77d8c57c3d2d5b71780564ebadb46773b7c436a6205b836ae231c68f33317af38a96e61b2e07f88cd267
SSDEEP 96:ZqONkIQsjpfmUTmDK5ih/cIPURHl8h4otop5K5D3ZBhPwivh50xy0SFYKEAxnO0F:gONY6kDfQmiUyUvZ903yO4+TQido1U6
TLSH
T13902E8356C782CBB9EA3AE49F54737275FA5112FEAC52FC4D9E82A1C00C734C2746826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f87e70c7e70330ed25ff115e96614d027d21cf76056e5c03b8eef20ea9353dde
MD5 42f747d8e1fd2603be90a051ee795dbc
SHA1 5a2f123685e08136bdc0b9bc3cfaf1bced2bcdbb
SHA512 baff6a52ae838ac32e76c71f01bdce825a6a4cd8013269b5ad14fb355387aac67a78d7512f7cc10d07e2ebbc0a0113a656a9edb846f547f426d47697ee8a9d78
SSDEEP 384:OOZcIhsNrUYNTe32khOp3VeVT+HBbsKos:Oshp3tOpUTgxL
TLSH
T1C7828C72AC789DBB1DF6D10AF94236035EB88067E6C92FD4E4DC7B1D04DA798130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 78be6c30946b0b3497ad1abaa540a7282e874f82eefe8ac89720edb1f342171e
MD5 c778880de7fda758d307e9d1a0c60d9d
SHA1 b3d022fbfe1d1a2520444ea9b5ba9d656f1677a2
SHA512 39ad4c029fa5e46e6e8a02b4bed09a9f9c05a6a9ad6dc6242e67678db794a00b3441c16762290fc7a125b47886d3f0d5daf56afd87f6b9d3f7d2cdf870d11f7b
SSDEEP 192:9ONJ6kJQmiUyWvi903yO4+R5pbr9eccRpqCU6:9ONJ6qBi9hOp3VeFTU6
TLSH
T16E122B3268786C7B5EE3A949F48732139EA5812BEBC97FD5D5DC2A1C05DB35C130A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a011c04b9e1338d81e1b920a8290565746e750fa6073d55d347bee351d774fc8
MD5 bb7962b3066bc1a64114f0e76aa7a21c
SHA1 5032bd308c43c24be114eacb732d03535cd1eb9c
SHA512 19335ba4c5e83ec020af426c204bd71f10a9a7cf071236151d56ac0757da7d21933070a170cf2ebf0ff6d979067de4be56782485bbfef4ecc53a476a844fd896
SSDEEP 192:uXm+xasuheOwQxMGsNrUZQp0LSm9rQmiU1z2p4k03yO4+R5pbr9e4LIpqC+HBHtr:NZcIhsNrUZNTQ2khOp3VeVT+HBbsKos
TLSH
T19C827C72AD789CBB1DF6D10AF94636035EB88067E6C92FD4D5DC7B1D04DA798030A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 86bd68a0585fe6397e70d0df3fa79029f6ce240c4584d9cf9e2c0d4903841439
MD5 9ac25d1cdd54e6fb94918c400e4bc57b
SHA1 a1128c523b823d7dc9d86bc9016a36003af8d71a
SHA512 912a9a32f84115be839880e9aae5cbd61a32b15060fb0907e5d9a194309b9c885c0ff4cc0bf5db210a3d61662be96ad68958d2b8c62e5c7651c64a06cab91099
TLSH
T115E00203530050E5C128033801531B0469934030099201445F2241591D253001D30B40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 59a0ce721e7419fa2372696a63b868eb92d19ce1fdb7b0c2f61f0a9842c11ec4
MD5 3060fef9b8807c1d8c82270bc205b298
SHA1 546d3f1c117d66bc695e60775042003bbb128188
SHA512 c5747018b97785372fe167701236508edcbb137972291ca7d4880682a7dc676b82eb2fb4f693c1fedd52ca926094167b6655f665e25601b18c08294b995c0359
TLSH
T11DE00207530051EAC128033801A32F246A9380300A9202555F32425D2E253001E30BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5907c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5907c6.TMP
Size 392B
SHA256 bddebbee25873e01632c8ade7c0acb7d224bb9355f18a04ca8940833d731adf8
MD5 e40bda9b81dad172db5e93f685a44428
SHA1 48fca91a25daf8c758a54700073db805595279c7
SHA512 ca6f4d81132b7b6a58863e70b43e6b1e930af4310b3b45450fceb3b05a9856951292f604e94ac177284634e75f4cabf584f4588bc6259016a6622293c921e1ff
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cdb34fcd8fdad5b073ff332980495b6b7820fcc8a04355ed91c9360340c61a5f
MD5 7f1905f62d35a0f4f5050b498fb1f4a7
SHA1 34b902550b58d33335a02e2cbc87916b317f5939
SHA512 ba14635487104c8e69faa4be0b1f2815fbc07f61d529bb265cdd72a4d523710bd8ae397df25dae0c9384204329691f229aedfcbf5f8404c620b2a41467a800f2
TLSH
T1FF410B59A6FA1148B7B36F5A5BF6A86E087ABD372E06D45D40110E4E0A62E00C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads