f67f142ff4edbac5143b04c7e685fd236afdc875bafa737b0b5e4b01af5012dc

Analysis

max time kernel
300s
max time network
190s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IT2409455548619.html
Size 17KB
Sample260826-k4ef7sbl2v
SHA256 f67f142ff4edbac5143b04c7e685fd236afdc875bafa737b0b5e4b01af5012dc
MD5 74332a41545223b6b5b681e9503891d3
SHA1 0c86018ce0decee9e6955f4e96c3d9e3378f21fb
SHA512 9e57927939b81187849a294c9f0b3d4ae55d8375f015b6ccb6e4edee0fdc8fb08f088ffe2a95115e91a8615d089dec4f0a10ded1e2be69c85e4bcb676c0beecd
SSDEEP 384:TFAmaDyAvnF5DGKDg59h6z601YyRvTORFYGA0bMZ11Gwwm8hM:erorZ01NvTORFYGA0gZ11Gwwmz
TLSH
T100820906CACB01A1291253CE2BD7E94633F0D487161DAF68BAED538C4F9959083BF66D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4352	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322089461561197"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{F0B1D839-7E01-46A3-9895-D2CA599880AF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 4444	832	msedge.exe	89
PID 832 wrote to memory of 5628	832	msedge.exe	90
PID 832 wrote to memory of 4352	832	msedge.exe	91
PID 832 wrote to memory of 5628	832	msedge.exe	90
PID 832 wrote to memory of 5628	832	msedge.exe	90
PID 832 wrote to memory of 1492	832	msedge.exe	92
PID 832 wrote to memory of 1492	832	msedge.exe	92
PID 832 wrote to memory of 5996	832	msedge.exe	93
PID 832 wrote to memory of 1732	832	msedge.exe	94
PID 832 wrote to memory of 5996	832	msedge.exe	93
PID 832 wrote to memory of 5996	832	msedge.exe	93
PID 832 wrote to memory of 1732	832	msedge.exe	94
PID 832 wrote to memory of 1732	832	msedge.exe	94
PID 832 wrote to memory of 4844	832	msedge.exe	96
PID 832 wrote to memory of 4868	832	msedge.exe	97
PID 832 wrote to memory of 4844	832	msedge.exe	96
PID 832 wrote to memory of 4844	832	msedge.exe	96
PID 832 wrote to memory of 4868	832	msedge.exe	97
PID 832 wrote to memory of 4868	832	msedge.exe	97
PID 832 wrote to memory of 3624	832	msedge.exe	99
PID 832 wrote to memory of 5208	832	msedge.exe	100
PID 832 wrote to memory of 3624	832	msedge.exe	99
PID 832 wrote to memory of 5208	832	msedge.exe	100
PID 832 wrote to memory of 5884	832	msedge.exe	102
PID 832 wrote to memory of 5820	832	msedge.exe	106
PID 832 wrote to memory of 1240	832	msedge.exe	107
PID 832 wrote to memory of 4912	832	msedge.exe	108
PID 832 wrote to memory of 1008	832	msedge.exe	109
PID 832 wrote to memory of 1008	832	msedge.exe	109
PID 832 wrote to memory of 4112	832	msedge.exe	111
PID 832 wrote to memory of 4160	832	msedge.exe	113
PID 832 wrote to memory of 2492	832	msedge.exe	112
PID 832 wrote to memory of 2492	832	msedge.exe	112
PID 832 wrote to memory of 4160	832	msedge.exe	113
PID 832 wrote to memory of 2304	832	msedge.exe	114
PID 832 wrote to memory of 2304	832	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\IT2409455548619.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d0,0x7ff9cabac188,0x7ff9cabac194,0x7ff9cabac1a0
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,15305665137447718295,6599532513174840821,262144 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,17604687445537998915,8759026639365071810,524288 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,16430906692390555033,3425607930475375268,524288 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,9371564472320534995,11589784672657950263,2097152 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,16584176079614330644,16438248410231562458,2097152 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,8688804000634938213,9998625206999566984,2097152 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,2316019032037932355,4117102357085071789,2097152 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,1725294619840749751,13524743629788939997,524288 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,8067400679035437214,14490450134618034995,524288 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,15348932134710918484,11294973379341382452,524288 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,15348932134710918484,11294973379341382452,524288 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,17548137170448763396,16697641046213990392,524288 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,11897157534301571574,2692276281394558311,524288 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,9755969212874488027,11256690895435589544,524288 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,8708848848830220103,15230640315998531483,524288 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3488,i,3651852326056115532,14493962635304950161,262144 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,9227474934070163581,16982262237634668080,524288 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,9207975251636996625,5414273142568198280,524288 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,3062133685054427945,12380458279372176915,524288 --field-trial-handle=2296,i,15444314987269881453,15979871940471047701,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:2304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 796d35219d54305fea9aeab9f260c3a965434bff6163cac43f60fb78e9262ee4
MD5 70157a5306cecb31379b49808f0de8cd
SHA1 93adb44e5876aca1044bf7755e3bd26b5e4808b0
SHA512 6e82e202931adad8e3e7288831f5036f6b4a93d67d6da0b162428114b75b75e86eb2e7df2ce16ddd56439e2a8c0a9ef6970e0b96b43e8a1e0ed6bced5c682285
TLSH
T19641095413B60ADEFBA4D6F36FD27E9936B8D8F9080F2F9048D1A2F13E057241152761
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cd2a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cd2a.TMP
Size 2KB
SHA256 51d30279be50bd9ca180c225fe39363464e0857f9a9707ef2d433e51c3516f66
MD5 619f4f680887999866d73d080121f70e
SHA1 26f3071cad5a66fbe0ff737d92a58a03efa82378
SHA512 cc01e8889079dada75f7ad710550401e4c5df9e5e594861f0e0f439f2397b91d9df0685a55458a71f6eba4ec332809f49ae7a1bd206b46607714a1d6713fe4a9
TLSH
T15941F85413B60ACDFBA4D5F36FE27E9932B8D8F9080F2F9048D5A2F17E057241552761
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2f95cc0cd62f4878ec45fba6100b3829ff9877fc3d736ebf9e9f3830561b3a4e
MD5 b81f2a1e554d9389c507446993926115
SHA1 22de2cb5638d6e1a32b91c2a441312a67fe390a7
SHA512 6360f8d79eb9a9035c333a439dd56643e5552bfd369aa9185a00c452956e2dea82a5b83c6eaf778baf6aa07788d941cb5701620965b27fba4781e84c4b831c31
TLSH
T1E031AEF783F4956E8A0196F0EA14AE2FCE2D0515431C7C6AC5E0AE2793F3472E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e60df86632a78c269c6c6e8d41333c164ba810b3ca76a286e1e2c72678d8dc7f
MD5 3ed98ef359d60960ed38de932c3683d8
SHA1 daff4570abd5e0420fb758536d415d9dabf6dba0
SHA512 de105a6bcd802674804d8a0c939b0ac1ae17e2a7b4b94224210bcb957b66574d001a662983843cb358f932d38ee5211bf2c8f7c6f2f8118c854120331796b79b
SSDEEP 192:sxRWRgyM/jK1Ml8wb3/fssU1sdmYCbDFzoA8p4B/g6+WNIYEgHxGGWpIgIJ:sxRWql3/fssU1tPDoo/5ISis
TLSH
T1EC62EA05AA349D7BCCDBD20DFA55BF63D6F91573A1501E04AAFC8A0C00E6ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d5411195ffe36b220bdd8a4b35a327c639b78b3bf17d59cdb3bc4451a5bc8345
MD5 46dfa10a2f34ce58ee5f06b12a380307
SHA1 3b9737dd50889ac46ce9050043eb5974f49920d1
SHA512 724725aba27ca7956da09ae8d49746f70ca8e17ed0268d03d8daa302f5a604594694886eafeb4a967c08885f75c01d762b1ab08587c942d3af3e125b501d831e
SSDEEP 192:sxRBRgyM/jK1Ml8wb3/fssz1sdmYCbDFzoA8p4B/g6+WNIYEgHxGGWpIgDGJ:sxRBql3/fssz1tPDoo/5ISiO
TLSH
T19B62EA05AA349D7BCCDBD21DFA55BF63D6F81573A1501E04AAFC8A1C00E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 23aff55d850f9bbcc09c484c756e2b0b1306838e8cb7b332eafee4c2f064d657
MD5 ae2fba0008ce3a460234bd1cc99883bf
SHA1 51f61ef1f2196629c236f4cbdb27f181a47f52a3
SHA512 9549c0246d27fe32ff8494a9b93a538b712887c8655ae5d911761a6eaeb0c50dfc33b4900816908c353fe560aecb6c26a171e777792ead56487655afa6dc907e
SSDEEP 192:sxRBRgyM/jK1Ml8UQbb3/fssz1sAKmYCbDFzoA8peB/g6+WNIYERfuGGWpIgDcJ:sxRBqq/3/fssz1/PDoG/5IgiM
TLSH
T10A62D805A9349D7B8CDBE21DFA45BF63D6F95473A1501E08AAFC8A1C00E7ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 07c944812dc5e46e678fd37cb1fa3bd5400ddd46cef907e8f8485de7f262ea10
MD5 c689702fd20f4bc36c9e66be1c8b564a
SHA1 f4746c3c06cb2abd083ecfe303048d0d2a1bbb8d
SHA512 82f2f9940d4ff4a0a537e1051d52144f1e579731f68d4b8cdc62c192eacd99354a87cdaa62c6777f354fca8131dd24d4da0485ff1caf053602e665f05469edcb
SSDEEP 768:40D76DrQD8f0DbWgQ6DjfPQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVw0DjGQDL6y:40D76DrQD8f0DbWgQ6DjfPQDFu1jaj0d
TLSH
T167C21B2B540CCB7F4F804EADAC29AED66DD801CB97984D9447EA890C03C77EF521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b912947fbab644388a91ef35141151520aeb4dc58e502ee70d66cbf1886d6872
MD5 5d7e1dc2dd62313f9a72b63900889e69
SHA1 b8a639ad19e93ff6754f2af389d4fe0132564458
SHA512 8be4d69651eb7b3a6d16c9088e6f64b80dfbcb23a5f54a1824d5936b17a4a3b531f53bb6702da744002a88a30b19933ae756560b78f8b9064aa58763eca9bbc2
SSDEEP 96:KRWLa2Q44eWIdFgWeK4rgEec+W10m/HFSr/VPTXWbAOgHXK42gZXc9lYrSV6h13G:CWLa2Q445IdGWWrgEN+W10m/HFSr/VPo
TLSH
T149913B5432B746C03C3E789C817D896F51827A633214A93B3BB941A29FA7E064DFF5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f5799ffb-a358-4a6c-8f7b-a193bdf6d2a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f5799ffb-a358-4a6c-8f7b-a193bdf6d2a1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 77205e2ae2918a10773e65ec796c4e5cedfdbcedaf36fb7564b60f6cb36ec00a
MD5 77ab7391769bebc84715abb90a58151a
SHA1 34220b748298ba3c10d706a5897d4ccb497c4f8f
SHA512 b73aeef0044aedf2592ceda643443fe720df0fccff6f65b0d1dcb129f532be20a884865a84738bffa38e5eeb57d4b2b17a5a68622d0ace41eda19f38bbd688d8
SSDEEP 768:krv+4UNbdy3ul1DTd+ZN21fceX6+qTko0u229a4vsTGx+S/:kbsbQ3xIxrvVTVKa4HR
TLSH
T1EB13BE32F8799D378DF2D684B20B65872F78116386C80B5499ED6A4D058F1AC270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 caa91d90f38bae729bfba7d3f3e9fcf16efca7bf838904c9a5f8515befbcc3d8
MD5 f5fdca9ef388d90ec69c51592beee4f5
SHA1 0f791950a18f0c0867c73b33a3db1b40fa5ac456
SHA512 6d219e3363b87d6016cf5c5de647a2e21831b629eeaaad31dc50aad424dd7f141dea7fd1d8b8774bcaab251b4df36730d531f80e859c7f69dad957a2473c0610
SSDEEP 768:pFQx3/wgg/dt1DTd+ZN21fWeX6+qTko0u229a4vsTGx+S8T:ox3SSIxFvVTVKa4HiT
TLSH
T13F03AE33ECA5DD7B9DF6D7C5B60A31435EB54163CAC89B50AADDAA1D004B2AC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 ab28db791bbb328749671cc8165e2af0b5a557fb299292f6210b1ef804099ac2
MD5 769ea286b4b93b0ec7cacca474f0d663
SHA1 8cd22c1f2f2e128be03687318ed532d10afb0683
SHA512 6125252790577836e8e1b06154c6b4172823455aebd453bccb703f53cc8b4f230a39a0f8490245b9479384a241d7eb46a83cf5ab7380db536256683a439331d1
SSDEEP 768:AJ3l/dt1DTd+ZN21fceX6+qTko0u229a4vsTGx+S8T:AJ3lSIxrvVTVKa4HiT
TLSH
T1DAF2BE32ECB69D774CF6D3C5B20A21836EB55123DAC85B5499EDBB0D054B2AC170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 310dc2ece0309e8f940d40b7ea5393f55430087fc29c0d98b63e1425dd809319
MD5 69ddb62e893e449958e70314c1697ba7
SHA1 49102f25b703c988310dcfabbc89218a36f6291e
SHA512 8bafba3ca9e4c88db3d91806be4f6ce8064f4c350ad351c293db71fe80caf276382cc7c2f2ba15ea29a38c7ae7bcb0b847a2dd6b6e0979cf9bf5e74ce48a5746
SSDEEP 768:QJ3A/dt1DTd+ZN21fceX6+qTko0u229a4vsTGx+S8T:QJ3ASIxrvVTVKa4HiT
TLSH
T14EF2AE32ECB69D774CF6D3C5B20A21836EB55123DACC5B5099EDAB1D054B2AC170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 339460f71cd738bca96d6d4a827323d76d4aa639dbedb299feba8d9c9df148ca
MD5 1dad77c2aff56c29e73ba78e3e19a3e9
SHA1 7c1532f62f241db94a782d7aca1e1a10bde5bbd0
SHA512 08fe492c0a44ddfa1306c1fef15bee0dfe21b035dfcf7c727602f366a910b3c1a5349f708208048608dbfaecb761833d0580bfea8dfea7d98583d1c648d62c5b
SSDEEP 768:prv+4UNbdG3QZ8DTd+ZN2reX6+qTko0u229a4vsDFeVH1SdW:pbsbU3WIavVTVKa4YEH1h
TLSH
T16803CF32E8B58D778DE697C8724B75572EB91163C6C80B80D9ED6B0D068B5AC230FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 c34e5cc416acc7fb99ffc3261b84926eee41022ee3bf883fc8e6ecf809562d21
MD5 94a801a58356a5bd768e636738803a81
SHA1 87b005fe72732b706cc375d62ad3161d478d9a32
SHA512 eaf18fe9b6d30082d3c97759cfb801eb6f609b4853f38f0012135ec376fac6d002aa885faba69527adcd68bf47b3b31f8b97c0fa70acf4e4ed5af83315d5a785
SSDEEP 768:mrv+4UNbdG3FbvDTd+ZN21f0eX6+qTko0u229a4vsSGeVH1SdW:mbsbU3CIxzvVTVKa4EEH1h
TLSH
T17C03BE32E8A98E378DF2D784714B71472EB95263C6C80B90D9ED6B4D068B5AC130FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c70504bd-abbd-4195-90f1-e9dc2628d6b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c70504bd-abbd-4195-90f1-e9dc2628d6b6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download