7dd47dc415b3bf831018ad6e509f79fc6c3dcfbd5965d50f12e9329415ad14cf

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin.html
Size 5KB
Sample260826-pp46jaygnd
SHA256 7dd47dc415b3bf831018ad6e509f79fc6c3dcfbd5965d50f12e9329415ad14cf
MD5 1fcfc4854f8042fcb3230d1e7ebf0252
SHA1 07714872f21ed5b6e1a3291521f93d4def8ba345
SHA512 b850cc206dd86a16255816408994eb9101efeac80e7d22a059ccd1d459aefbcface051d548bf684a0f1bede92bab502308252f6f5625783d3d7fe8843cb03897
SSDEEP 96:fjFj7jOjEDDK/D5DMFLzLexR9yeZNeBuw7RslvaQxvbbjdnx/ICM:fjFj7jOjEHK/VoPygeZyuw7qlCejbBnS
TLSH
T14DC1B536B9BE113E11D3826331BDE70A3A71C053DB86188076BCC6755F8AF82AD1B6D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
780	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322210803698044"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{7A763859-447B-4AC5-BE24-C4FC5CBDF97A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 5072	3288	msedge.exe	84
PID 3288 wrote to memory of 780	3288	msedge.exe	85
PID 3288 wrote to memory of 3672	3288	msedge.exe	86
PID 3288 wrote to memory of 3672	3288	msedge.exe	86
PID 3288 wrote to memory of 3672	3288	msedge.exe	86
PID 3288 wrote to memory of 1972	3288	msedge.exe	87
PID 3288 wrote to memory of 1972	3288	msedge.exe	87
PID 3288 wrote to memory of 4664	3288	msedge.exe	88
PID 3288 wrote to memory of 1140	3288	msedge.exe	89
PID 3288 wrote to memory of 4664	3288	msedge.exe	88
PID 3288 wrote to memory of 4664	3288	msedge.exe	88
PID 3288 wrote to memory of 1140	3288	msedge.exe	89
PID 3288 wrote to memory of 1140	3288	msedge.exe	89
PID 3288 wrote to memory of 3316	3288	msedge.exe	91
PID 3288 wrote to memory of 4316	3288	msedge.exe	92
PID 3288 wrote to memory of 3316	3288	msedge.exe	91
PID 3288 wrote to memory of 3316	3288	msedge.exe	91
PID 3288 wrote to memory of 4316	3288	msedge.exe	92
PID 3288 wrote to memory of 4316	3288	msedge.exe	92
PID 3288 wrote to memory of 556	3288	msedge.exe	96
PID 3288 wrote to memory of 556	3288	msedge.exe	96
PID 3288 wrote to memory of 556	3288	msedge.exe	96
PID 3288 wrote to memory of 2380	3288	msedge.exe	97
PID 3288 wrote to memory of 2380	3288	msedge.exe	97
PID 3288 wrote to memory of 1868	3288	msedge.exe	98
PID 3288 wrote to memory of 1868	3288	msedge.exe	98
PID 3288 wrote to memory of 2980	3288	msedge.exe	99
PID 3288 wrote to memory of 2980	3288	msedge.exe	99
PID 3288 wrote to memory of 2980	3288	msedge.exe	99
PID 3288 wrote to memory of 3988	3288	msedge.exe	101
PID 3288 wrote to memory of 1288	3288	msedge.exe	105
PID 3288 wrote to memory of 4212	3288	msedge.exe	106
PID 3288 wrote to memory of 4220	3288	msedge.exe	107
PID 3288 wrote to memory of 204	3288	msedge.exe	108
PID 3288 wrote to memory of 204	3288	msedge.exe	108
PID 3288 wrote to memory of 1696	3288	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\bin.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa248bc188,0x7ffa248bc194,0x7ffa248bc1a0
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,9516195352502416820,14141332340851115928,524288 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,4289271713356983261,13801749753066888684,262144 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,8033342796406896053,17153416314961434152,524288 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,16114655004807299400,15572915790518874036,2097152 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,3571293184807881362,13381612245255049508,2097152 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,13550043846241323708,4833639570607352724,2097152 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,450049257841949668,10261704393343044315,2097152 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5076,i,14915065983789283972,13251963962244985993,2097152 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,4931573216324855480,6896294268338952516,524288 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,4352548030675684956,16210787577869387364,524288 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5624,i,16140535481265814488,12378245359242187715,2097152 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,1833459377133516146,4553945202471265056,524288 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,1833459377133516146,4553945202471265056,524288 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,1782589137184401819,8252355976490161780,524288 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,13849693487779830056,5193373502220077138,524288 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,2872811598632002805,13329670798775209968,524288 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,10231023314854852319,10910018572001709900,524288 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3004,i,4619426225951510914,12338377051206971286,262144 --field-trial-handle=2304,i,6376015181916893228,14243279700571259911,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0c55326b35a6ad242204418ea33f558d958be16a602e74c27e04c72fcbfe85be
MD5 1b4e02b45b69d84d49c45d6d958eda7e
SHA1 c02c0934ff6d0e9fbc556958415f4f0226fafe06
SHA512 713d97c1b59de8556bfc9d089060d545e1d7b271ff081a67a38e2b9014162f1ae06e0979186f156e9e748f3db9a7873536dc9bcaf7a4942248a866853efc03d8
TLSH
T19961073C32574187E75F86F0F8F95E4C327941BB9B1F9E3C0668483D7A08B2A8023418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3c1aeb7c57b9a2f195fe1e62403e9dc42d44c79d651ed0035a05400f08d6936e
MD5 1da0e4b92b6b3c6cd35fb93c7d7e8460
SHA1 91f7b78bf4dae8025c72a8e845d4785dcaf178a7
SHA512 ef1e2a6728ad79a35eee7913ac1b266152634b25541e3798dd21b848d48482fe65aa09c4585704e6d100676731330e434db6cf521ee6a0bee7aafe0177a9bf9c
TLSH
T11D3181B6C2D5876E881153F09B24AE2BDD2D160A422C3C668EF5FF1F53E2175D10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f8bfe6782f3258af2980cad1406376b4885ecddd1608afe8bd09bf923d06b521
MD5 617ca91a07f0de04e839beca38cf484a
SHA1 3ce3de6fd91a2e3339b2cf8958944531216f8482
SHA512 c356cb1a7628cab0e4e1b9e3ca4f1762d6f2e4cbdfea7f498fc3f9d57361d88b0c066448751f001feedb4137e5fdfebb42d9facddc8553f3d6ace1dcd77ca93b
SSDEEP 192:sxZyRDkN/fMsL4LIdpdrHW6+WNGYLzcdXIgrJ:sxZyeN/fMsL4UBHbGv9
TLSH
T1DB22C8116E78A93B4CC7D20DBB15BF13E6F95032A1951E98A6FC961C05E7ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 16f66d569fe24411ddf6cf6eee9b7ff904dad5b22590152bafc31555d89ef1d6
MD5 5c2acf73cfc3446ab8d9bfbbaa7ee15d
SHA1 4fbcd9692112c3063851ad85ee243d132be55ea2
SHA512 fa69f8d7da3273b564309276a882cd43afed0850d691321885f77ff04b846d91d9cc7b201582ae0471f463ccff1b0bfb55fc3b3577038216d8fdefe301044dbf
SSDEEP 192:sxZyRDkN/fMsP4LIdpdrHW6+WNGYLzcdXIg5YJ:sxZyeN/fMsP4UBHbGvG
TLSH
T1CF22D7116E78A93B4CC7D20DBB15BF13E6F95032A1951E98A6FC961C05E76DE220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e934db9c9c254252007587d7485419754a5d1960f5d03fb4cf84eb384eb9ca98
MD5 c1fae9be1605d77a724db4321e953c4a
SHA1 4747bacb34eabbd313d93eb7e99be495a8ffe3fd
SHA512 e8871ca3fb18b5de4fd361be0239237a87264fcdfa6d2d2698abe7c98c06e3e26c1909b33fea7a0df6d1b18f06b1e645bab22d6cfc336f82bdbdc9665ac85bbb
SSDEEP 192:sxZyRDkN/fMsPULIdpdrHW6+WNGYLIEdXIg56J:sxZyeN/fMsPUUBHbGmE
TLSH
T1B722D8116E78697B8CC7D20DBB15BF13E6F95032A1911E98A6FC961C05E7ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b81794e9ab64c5321769348b597fefd75762f0d2dfdda260bba75b47ce9f809e
MD5 4d50472d47bc0e27df20169575bd9a8b
SHA1 87fae60017d17d01f460122a88750b7c2aa4ee86
SHA512 8b6b9fd18ea68e5217e16c4b26b337a21b504e0092d1081db8be954a1db14401bd0bef4d93a9a40f887b737d6f3a621ba4c6440fd8babaaf6e7e057bd40613d5
SSDEEP 768:hwO6fP1Wvxzfj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkILlWwJvqropv:hwO6fP1Wvxzfju1jaZILIsvBpv
TLSH
T1B1C2E83B240DCB7E4F801A9D9C5A6F973E9802C7AB588D8447FA854C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 97bc559a5e70d7a65a774ba84d8c8af31fc3595bc4f6a4b4aa886c6d4a8c2bbe
MD5 e3b823d88240215d8a27689be8d203ed
SHA1 c83a1b72f6acb113a283b72c5fd50a4387c9110d
SHA512 3624c492cfa6d2f9af6401130d4d34758e99afe5fb685b8368b2511d6455721a5dfff66733e579da9a8c09d28f4a423e3500ea10046c3420b68e5a7c869e04e9
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFOuI3KvasrylxIhKq009:KUAAKteP2OuwKvaCOxuKq0u
TLSH
T1F1A1311372BB03437C3E284C9295CF664B4276A33018B42B37A910B61EAAE344DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59860e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59860e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c38b489cd1b699aeda0604764c559f32b5b18458999a46af0979487b13eac706
MD5 755da8abcdd2396717d3740cac26aacd
SHA1 a426e09cdd119a842f3fa86eae19841863d279fc
SHA512 5dba05d21a852a1b0f2975fb11208c1fff7871f0b2f027cea52f9cfe84895773dbadb0ae3f845306e0a7e2fa2ebaceb912f6d4f0e0b1aeb4ee8c17f6dbeee79d
SSDEEP 192:u7QLsNVSQWlYeS7+3vgQQmiU1GIh4atb02O2bbh2e/FF0SJreLM7q+eJZIK1B:hsNVSQs15Oa9DOMMe/7zJrni4m
TLSH
T1BF42283168789C7659F3A141F9473A139FB4806BD9852F84D6EC6F0C01DF6AC235AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 9fb748730db8a32fe094a4ae43f1e153c481d75f185665e77c0efae12917d2b1
MD5 9966b800a41436e7fbcbb0128186b0ab
SHA1 8d96bb8f2199d90cdb1d9cdad21f9b67bec0c0bc
SHA512 03084e13cc458ccff3edf703572560a43ed122af556e479864a72905a246044e77a9fd194ee4894d6eb080d8b8ba3e586532b4d9fbb30cc00bd6f48684171a9e
SSDEEP 384:9iFSsNU8TUNTUlIljQs15Oa9DOMMe/7zJrGi4p:0FSHwgumPJO+/fhGi4p
TLSH
T11C622A325864CC7BADF6AA41FA4B36139FB440ABC9956E90E7DC5E0C01DB1AC234AC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5969d5e7a6e6923ab46713902d6ec54b806fc61be18ad40cb82205ab85bcedcc
MD5 70b9f1cccfd1d8fdf92533fc7fda7daa
SHA1 469c927be8915dfcd4bc35265361d0d8ae7390de
SHA512 9f9fca70c1945d42171fe283c9dec17012f92a1886afb8bec3bf1473e12c7c32c85f2df18e20b18339d82e809d83e973c721aba9bef0f1b65be657fe1f642128
SSDEEP 192:qON8S6O7+3hQmiUy6OGttb02O2bbh2eQgGtoiU6:qON161IGt9DOMMe2lU6
TLSH
T1BF02F9346D686CB74AF2AE45FA873B239FA5102FE9952F80D6E81F0C00D765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1f454551c27fa060967f99e074f2a82b8a30e4d493c106775e5e29d992251444
MD5 2c8dc564548d054d672215b2296340ac
SHA1 a116f7402fa83fbd9f716283804d67fb7c1b4927
SHA512 2870051b314422e739cbc190a1016a1ae107550c008e249b0cd6872c37f127f32ee9d0b955f3dcaaabb1ebc12745667e1ecb5113cc6ab1a411924f282ef7f08f
SSDEEP 192:umQLsNVjQWlYeS7+3vgQQmiU1GIh4atb02O2bbh2e/FF0SJreLM7q+eJZIK1+:0sNVjQs15Oa9DOMMe/7zJrni4p
TLSH
T11542283168789C7659F3A145FA473A139FB4806BDA852F84D6EC6F0D01DB6AC234A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 8e4169cb1a6718a1d53a9562014ebd9d75244db3a2e0da7e5879d5b7c5d49e43
MD5 e6f3e8e5f78eef47cd44ebfce5a6396f
SHA1 1758edb881a7fe18437d2a86a9df6f5c7eaae5ad
SHA512 4b66e90479791122997db9702272a176d06a844b5df19f857b3ff4795868a38e38673b2fce8da9c53021d56a7704cdf5d3591e16f79d69c83098fcdb13563481
SSDEEP 384:9iFSsNv8TUNTUlIljQs15Oa9DOMMe/7zJrAi4p:0FSywgumPJO+/fhAi4p
TLSH
T140622A325C64CC7BADF79A45FA4B36138FB440ABC995AE90E7DC5E0C01DB1AC234AC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0479681523740fc171a5eb3389e2c431cf53d217d477ead56fdb5e5ecdc7f244
MD5 0fdce0a60eae68b7daa1109cb74e4746
SHA1 5f71ad3f83b43061f04548e394453da1eec233da
SHA512 e0323d142f137dd2c3c5f3acd891a552aefe296c05fbd912ad8d077911f1ecfe939c477cf3ba6eb378b27e2923bc3c88068a39cc9198786eacfa121d24427d5f
SSDEEP 192:tONA6O7+3pQmiUy9Oqttb02O2bbh2e/FF0SJr2cN7q+eU6:tONA6RBqt9DOMMe/7zJrXiU6
TLSH
T1B3121A3168689C775EF2A541F9873A139FB5412BED8A6F80D5DC2E1C01EF66C234AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d7ec8df-da4b-45fd-8515-69f34b5bff03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7d7ec8df-da4b-45fd-8515-69f34b5bff03.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 248fa8708dd02d43ee2f93873558b2d09d7ff4d6867b7ff3014bc8f6d04c3a57
MD5 5b74b362d4491c5e95a0f27434725836
SHA1 6632bf924315da998fdd9db2537d4ff9b1ec3519
SHA512 65bec23dbe2cf1112337f3cf9d026e2f451989d6c85492ccc0de5d3fa3f5147b9346f4cdf5752bc8be3616e99b6ea7918c51665dd34fed4dd02735ae26621e90
TLSH
T1A7412A58A6E91148B3B77F56ABF6B86D887FB9732E0BD05E10110D4E0726B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download