4badad5136e3eef2a91932cb615728d0bc2816fd5255d670db44fc5cfcf2a605

Analysis

user interaction
yes
max time kernel
241s
max time network
236s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Query-Explore-EXE.html
Size 208KB
Sample260908-fdxsmszzex
SHA256 4badad5136e3eef2a91932cb615728d0bc2816fd5255d670db44fc5cfcf2a605
MD5 e677f37ecc8cbaefd44a371fe7ca4ca9
SHA1 fd92d51c05f7f1c28596511cbb2a1fced076ead5
SHA512 30dd6d747acd71d51bb33b3c406f5399e69439ecf32a1804b4d3f50e04a7837d87edbf9413cea7c1b0c3189877962ce4691ebff2440115733ecff82cc8ea0642
SSDEEP 6144:irw3X2nRpNG/PbYgoggMTTZbq/juwZykZYC:rC
TLSH
T10824086F5B5128C8CF8705CFB4FDBC4FA6A96016466402EA74BFA008B3547DC42FA999
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1576	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333163731680160"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{786B4E8B-CA0B-4A71-82A3-B99C550A028D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3064	msedge.exe
3064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 5108	2520	msedge.exe	85
PID 2520 wrote to memory of 1756	2520	msedge.exe	87
PID 2520 wrote to memory of 1576	2520	msedge.exe	86
PID 2520 wrote to memory of 1756	2520	msedge.exe	87
PID 2520 wrote to memory of 1756	2520	msedge.exe	87
PID 2520 wrote to memory of 4072	2520	msedge.exe	89
PID 2520 wrote to memory of 4072	2520	msedge.exe	89
PID 2520 wrote to memory of 4032	2520	msedge.exe	90
PID 2520 wrote to memory of 4032	2520	msedge.exe	90
PID 2520 wrote to memory of 4032	2520	msedge.exe	90
PID 2520 wrote to memory of 1816	2520	msedge.exe	91
PID 2520 wrote to memory of 1816	2520	msedge.exe	91
PID 2520 wrote to memory of 1816	2520	msedge.exe	91
PID 2520 wrote to memory of 3272	2520	msedge.exe	93
PID 2520 wrote to memory of 3272	2520	msedge.exe	93
PID 2520 wrote to memory of 3272	2520	msedge.exe	93
PID 2520 wrote to memory of 412	2520	msedge.exe	92
PID 2520 wrote to memory of 412	2520	msedge.exe	92
PID 2520 wrote to memory of 412	2520	msedge.exe	92
PID 2520 wrote to memory of 3808	2520	msedge.exe	97
PID 2520 wrote to memory of 1916	2520	msedge.exe	98
PID 2520 wrote to memory of 3808	2520	msedge.exe	97
PID 2520 wrote to memory of 1916	2520	msedge.exe	98
PID 2520 wrote to memory of 2856	2520	msedge.exe	100
PID 2520 wrote to memory of 3996	2520	msedge.exe	104
PID 2520 wrote to memory of 1768	2520	msedge.exe	105
PID 2520 wrote to memory of 1080	2520	msedge.exe	106
PID 2520 wrote to memory of 3448	2520	msedge.exe	110
PID 2520 wrote to memory of 3448	2520	msedge.exe	110
PID 2520 wrote to memory of 3064	2520	msedge.exe	115
PID 2520 wrote to memory of 1556	2520	msedge.exe	116
PID 2520 wrote to memory of 1556	2520	msedge.exe	116
PID 2520 wrote to memory of 3364	2520	msedge.exe	117
PID 2520 wrote to memory of 3364	2520	msedge.exe	117
PID 2520 wrote to memory of 3456	2520	msedge.exe	118
PID 2520 wrote to memory of 3456	2520	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Query-Explore-EXE.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffb6771c188,0x7ffb6771c194,0x7ffb6771c1a0
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,8089357474439329393,11094646209607013483,524288 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1796,i,5126727213618527579,18294367048724193210,262144 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,2245792710639350312,8686439320859118705,524288 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,5580226224142157737,10489169580335062526,2097152 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,9489895526925741366,3398011288578135021,2097152 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,17348142974236078250,13168695270144558559,2097152 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,14587795749316200564,10352507253555160037,2097152 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,13201543999255807446,4843465495917981865,524288 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,6568458780521120144,4546349325695943963,524288 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,153987777569126127,118150976100096535,524288 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,153987777569126127,118150976100096535,524288 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,16846198648942203866,12012675545614930387,524288 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,17081757367968952874,15226511563240573989,524288 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,15012484196821814637,9048340874783653112,524288 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,17751502000957138342,14921203197490938973,524288 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,7615203693162419665,10616712410513513122,262144 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,17118499135874272737,16097719549046841917,524288 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,9899892632532735990,2183176624160728520,524288 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,5202236682332581903,1688198234030790312,524288 --field-trial-handle=2404,i,16608870865195460124,5807725293522296730,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2b697eddcb2b07f8539bfb3652953b0a60b5fe79caaa7bafd3e57283f337ae14
MD5 941e2ecafe7396f8e97c401afcc3b3af
SHA1 31446a30ef45517406a817809c058cb4d0f8977b
SHA512 222c47ab976196c3e2f6ff28796c492c670705750f2050ae0b523f8bda0f71b8f87e5338b508def4ce9eccd960b940f81d1f8e67bc05678f8080d5f069521c97
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T1B3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 1d926570abfe4c19c3099e30eb1454ebf604871ab7fce3f106b6552225e8592d
MD5 bed0aeb368b58e2a434f0f5b70318879
SHA1 d658c77cb822944925436cc0f40ff7d9d262d351
SHA512 e16220790539a3bbf48d7b5f72950d3ad073b1386d3327bf0846e86811469e74d577d990b7c62e0874e40a9de57adaca007c231434396f962c8184dbd90487ae
TLSH
T123E0D88E3B90C1A917099C6F80685F3E80B67A25958C86DA6305B68C555053A4B85DE4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ba5d3df9a966a91a409ef847acb3a15fc322ede57f75cee8f73f65a49fc3b693
MD5 a1785ea3ab0f804c62ff1d00a8fdd8c9
SHA1 c60db68bf1a4dc1a939685b7ba0ac7851407ba21
SHA512 b477fe78bb0814da416f4ddb19430498ea489aee87cfe639eff8516b7196c0616c9ba939391a5a55d036283303cfb9f29c93f694992e9b354f7585b1aa1f6067
TLSH
T1AE71D815017380B3EB243C31E5D93E9334FF84A83E9F5FA656D1457F9A0A7A6E021834
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58625f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58625f.TMP
Size 3KB
SHA256 961e91bdb7689a7b27164d712573f548a11ddfe3d404fa677e654da61b45d61e
MD5 0f7b30d919bff945aa56231ee69ec991
SHA1 f00f54e77ad55a1984670c2cbf8a95c13bc7149f
SHA512 efa33be7ef246f998cd477650fdc727d781bbbe2421db1b0f900640451ee2eab7841f98757bafa552b0c8f9cdab732c942bf35916b5b06a9241c0c09581e6128
TLSH
T11271D815057380B3EB243C32E5D93E9334FF84A83E9F5FA615D1557F9A0A7A6E421834
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 503c8ee3324c66367804301c1d16c9b5120fb1346c592706354ca00936fd9023
MD5 914b56c00acd43239a7c33490c94efb9
SHA1 131f28f2ee7c5a861633234a59973c49be17b16d
SHA512 9001faee172f90e88ad0adb334fa7df6406ce5f3e7041e2a66cd902509f7e0895700b0f28f25e7f3f8d4d22aae92962e6ca7311192710a075cf006d2cd5f1900
TLSH
T11B319DB7C3D486AEC91557F09A24AE2BCE1D0616422C3C66C9E4EF6B93F3075D10269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 da1d118f8b25ad148a8d9c9a6780e29741b019c7ba281d8f213a3c7be0a61967
MD5 9c60eb1bae2a6863a1bf11d8ec2cda58
SHA1 d55e7b089238dec44adede4e69bb098c18c5983e
SHA512 f856cf8ab8d169d244cc5a56a2b7e5353b2bbe9da285cb2cc01d1bcc47534fe9d782d29965ab642b5a1ca1b04cb52036c0566dff3726b0842a8c1fe392267e15
SSDEEP 192:sxZeR8yM/jK1Ml8Mky/fdslWnIdpdnHW6+WNGY4w40HIgrJ:sxZeqMy/fdslWoFHbGG9
TLSH
T1A2420715AA346977CCDBD209FA557F53D6F81473A2900E44A9FCCA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d47649eef94081983a0c3f29775ac90991460ec7b6541ed7885cfefdd7da980c
MD5 f183e38f9e5ea41b345370d67fb254dc
SHA1 eff5ec11f6bfcd638e0371dd33dfaab70cec2690
SHA512 69d8dd5ca0386b2dbc89d4ed3938815d2bb1b1120301b9acd839d0c6f21ecac4b113021fd659dcda26bdf687141f8b4a0c676fd2f244a1f5351704866d4b8960
SSDEEP 192:sxZeR8yM/jK1Ml8UQ8ky/fdsxNnIdpHnHW6+WNGY4tdjHIg50J:sxZeqqHy/fdsxNoHHbGtS
TLSH
T12652E615AA346977CCDBE20DFA417F53D6F81472A2900E44A9FCCA1C05E6AED621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 47b37d959c3c34944a981bc7534e575f4f48de4a7ba6736a07e12a906d248b93
MD5 746e88529f0b6d758e17924dd4e34940
SHA1 675daabc870f74966696b5462ecfb6a79658a12e
SHA512 5d7e4a2983e95621f1741ad70c02de7d59adb52690e7af1e020fee243dd66ea9127a9f479d5a33464a4eecddef3bac32908b0e2cc1982fb5047d8b220c6abce7
SSDEEP 768:B98iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opduro2kwUnn:B98iJPNWvx76ru1jahALocdlSUn
TLSH
T11DD20B3B680CCB7E4F844E9CEC266F966DD801CB5B948D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 1af41bd39696c9a3d60cdc5afb7c18a610146e94be4dc8f1cc8378301bcff2b3
MD5 ee2ea28b5761cb7e6e9b6d9c5f863072
SHA1 d99b3f8f8859ad173878e85c479d31a0f053bb60
SHA512 452d6aab3dbf499e14a63fce6c9ac9b834a364e4baf4f3bed6c5608b7448c0c65ec4a78e4fc2f491b3455d9fd6a1914695463de778757fc8204e691ef2fdb579
SSDEEP 48:KUQILKlCcTytFIxK20ceBIBKaEUTyd9IRKu0Mv7S5dTBBt0i:KUQQKlCS2FqK20hBmKaEaW9SKu0l5
TLSH
T1EBC15906317B1A432DBD6F0C96A1C71A474175A33018A92B7FE940794DAEE380DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fd95.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fd95.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a34818679f67e74231cc74495b12f683c0c19e954274087bdf4b27e72aad34ff
MD5 53aabd7571d3ef4be12177d323c2a696
SHA1 b127d1691566ce1ff5fe25823b53d07c70a5bfb4
SHA512 26e0ea18b16fc9b74844da151ffe38b2a5ae4de7c7fd66f3a1a42fbf37b9b3b1daac29154a15c9e846070f783b1f25e31ac9080890272d8f4322e3c0f9520a33
SSDEEP 384:cZcIhsNs+ccX9I/k8lIFixuvzxV+MhdpoDpo+:Kh6R66Fi4184potV
TLSH
T160828E715CB86DBB5CE7A241F48237174EB8E067EBC85F90D5ECAB1C06DA294130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 959cee801d16dc8ba1bc9925e1eab3946b742de56964d02d3230c904ac630bd3
MD5 7b3bd51497ac56c56710f54321446821
SHA1 3aacf410274c40a262d7e8be13e8f28a240e49ba
SHA512 60b39e9de6cf41ca594db32cb9f9e525928b51d304bcbb80408f970831cd2776588b30ae62da4eb8fd17cc70c010ad03c06b371a0e66cc6db2e515dda0ae8cef
SSDEEP 384:piFiZcIesNk8TUNTUlIlRccX9I/k8lTRixuvzxV+MhdpoDpo+:AFQetwgrR65Ri4184potV
TLSH
T167A26E735CA89DBBADE7A781F44633178EB49067DAC4EF90E6DC6B1C0197294130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7ba58a5d14c628fbc64c6bec5c0e020d89513c74df35f288da633b97645bef43
MD5 5e0a509da3937d8d0b804cc77298a775
SHA1 5123177c076e77c47e985cf02d081ff3220ddb71
SHA512 ebf2720bbaa5263f64a15b6fa29e870bf89a2e5631708555e619658d47fa655d33d5c2c18bf325a1d901b4cea93cba03dcaf90db2f51ab03bb2ae51ed7f86234
SSDEEP 96:ZqONkTQsjpfmUTmDK5ih/cIPURHl8h4otop5F5DRBhPwivh50xy0SFYKsAxXeYzP:gON/6kDfQmiUyXnZ903HLQib0U6
TLSH
T11B02D8356C782CBB8EE3AE49F48637275FA5212BEAD52F94D9E81A1C00D764C1742827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4fb6c3b7247d87606557590223171e3592c95fe892756f6920fea33e65ae9573
MD5 3dbfae9b6949cfb1400f1bef004dc791
SHA1 8e27147b7550cbd5b1eb7e7c64ff5be717d548a3
SHA512 d34fa137af813bd74679c514a6eafdd60a11103cf6ebfac40ae581b0b749e60b09da9d4480e3bd07bdc94602dead0dd60db7f83e965404c286eb667b2bd35fd1
SSDEEP 384:oZcIhsNsRccX9I/k8lIFixuvzxV+MhdpoDpo+:WhVR66Fi4184potV
TLSH
T1BF828E715CB86DBB5CE7A281F44237175EB8E067EBC85F90D5ECAB1C05DA294130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1515d9819e89e2dc6f673faa513b89b042a23715e747850dbce992bac2dee064
MD5 e5e564b63f11594dd2c95e4687c40141
SHA1 5ebb91881f078f772f54f57f7ed9b97cffc38067
SHA512 9239072e2d29d3bb48ed280052b7744655f9aeb8f32fce9941bad983b20df1d452cfa35331948c040a97d6c19fab570dc5147cce3d9a4c475d2ce2932dd1aeac
SSDEEP 96:4qONkdQsjpfmUTeK5ih/cIPURHl8h4otop5FgDRB9Pwivh50xy0SFYKsAxXeYzp8:jON96k7QmiUygnd903HZ/NDcREq4U6
TLSH
T1AC122A3268B86C6B9DD3A991F04336179EA5512BEBC86F90D5EC2B1C05DB29C2307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fe2ff3d5a6364c931c501f4bfb1a722778aa2303e08506656f282eb8e3d72800
MD5 4bcf56c98dcb0dda79352d12ce5fd99f
SHA1 3675f2b21044ebd05ccaee33eb1f7453b74d55ac
SHA512 e18dadbd1988039e3b93ba957541522bc18d5581976480cc1d01038245de6b68b7085933c21d15579642f31ab1de31b5639a11aac2b1d6ff7f71dbdc8a59b2d5
TLSH
T1D541FA99A6FA1058F3B7AF16ABF6686D487E7C772E0AD45E00010E4F4A63B40D971733
MD5 SHA1 SHA512 TLSH

Submit Download