hxxp://APP[.]SIG[.]UNIKO[.]PT

Analysis

user interaction
yes
max time kernel
76s
max time network
78s
platform
windows11-21h2_x64
resource
win11-20260513-es
resource tags

arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
09/09/2026, 06:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://APP.SIG.UNIKO.PT
Sample260909-hrqbtsshla

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4712	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334107200515086"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{9D90B310-B245-46E9-84E8-0D18430654F6}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 4280	4092	msedge.exe	80
PID 4092 wrote to memory of 4712	4092	msedge.exe	82
PID 4092 wrote to memory of 4748	4092	msedge.exe	83
PID 4092 wrote to memory of 5076	4092	msedge.exe	84
PID 4092 wrote to memory of 4748	4092	msedge.exe	83
PID 4092 wrote to memory of 4748	4092	msedge.exe	83
PID 4092 wrote to memory of 5076	4092	msedge.exe	84
PID 4092 wrote to memory of 796	4092	msedge.exe	85
PID 4092 wrote to memory of 796	4092	msedge.exe	85
PID 4092 wrote to memory of 796	4092	msedge.exe	85
PID 4092 wrote to memory of 4064	4092	msedge.exe	86
PID 4092 wrote to memory of 4064	4092	msedge.exe	86
PID 4092 wrote to memory of 4064	4092	msedge.exe	86
PID 4092 wrote to memory of 5056	4092	msedge.exe	87
PID 4092 wrote to memory of 2224	4092	msedge.exe	88
PID 4092 wrote to memory of 760	4092	msedge.exe	89
PID 4092 wrote to memory of 992	4092	msedge.exe	90
PID 4092 wrote to memory of 5056	4092	msedge.exe	87
PID 4092 wrote to memory of 5056	4092	msedge.exe	87
PID 4092 wrote to memory of 2224	4092	msedge.exe	88
PID 4092 wrote to memory of 2224	4092	msedge.exe	88
PID 4092 wrote to memory of 760	4092	msedge.exe	89
PID 4092 wrote to memory of 760	4092	msedge.exe	89
PID 4092 wrote to memory of 992	4092	msedge.exe	90
PID 4092 wrote to memory of 992	4092	msedge.exe	90
PID 4092 wrote to memory of 4364	4092	msedge.exe	93
PID 4092 wrote to memory of 3416	4092	msedge.exe	94
PID 4092 wrote to memory of 4364	4092	msedge.exe	93
PID 4092 wrote to memory of 3416	4092	msedge.exe	94
PID 4092 wrote to memory of 1624	4092	msedge.exe	95
PID 1624 wrote to memory of 4508	1624	msedge.exe	96
PID 4092 wrote to memory of 4500	4092	msedge.exe	98
PID 4092 wrote to memory of 976	4092	msedge.exe	99
PID 4092 wrote to memory of 976	4092	msedge.exe	99
PID 4092 wrote to memory of 976	4092	msedge.exe	99
PID 4092 wrote to memory of 3628	4092	msedge.exe	100
PID 4092 wrote to memory of 3628	4092	msedge.exe	100
PID 4092 wrote to memory of 3628	4092	msedge.exe	100
PID 4092 wrote to memory of 2024	4092	msedge.exe	101
PID 4092 wrote to memory of 4824	4092	msedge.exe	102
PID 4092 wrote to memory of 4624	4092	msedge.exe	103
PID 4092 wrote to memory of 916	4092	msedge.exe	104
PID 4092 wrote to memory of 916	4092	msedge.exe	104
PID 4092 wrote to memory of 916	4092	msedge.exe	104
PID 4092 wrote to memory of 3228	4092	msedge.exe	105
PID 4092 wrote to memory of 3228	4092	msedge.exe	105
PID 4092 wrote to memory of 3228	4092	msedge.exe	105
PID 4092 wrote to memory of 4176	4092	msedge.exe	106
PID 4092 wrote to memory of 4176	4092	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://APP.SIG.UNIKO.PT
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2c0,0x7fff3350c188,0x7fff3350c194,0x7fff3350c1a0
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,3961908758493745282,11619315381392070894,524288 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,2492390333552568074,5573130546202913363,262144 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,13469796105186861026,6470890470352379849,524288 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:13
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,12299671536586171759,11978845550145716781,2097152 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,9325776804347895659,1613589661224233390,2097152 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,1963472659844571,8688922039586770417,2097152 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,12637931028411459794,17625567554502829191,2097152 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:9
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4180,i,3689907984659740691,11062734552865963972,2097152 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4240,i,3946518856633077756,12474228305828296853,2097152 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:9
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,11855995035381245162,2112346189841742698,524288 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,5912328792633395980,13438482890818300078,524288 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,3018997609788354824,12344946916585464376,524288 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,5202106090345278727,8927368649919719573,524288 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,5202106090345278727,8927368649919719573,524288 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4300,i,16917053708598737375,17161875412803929343,2097152 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3748,i,2000620925087067933,11405419308901878852,2097152 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,10819883981515046150,8945441282587975718,524288 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:14
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,12602630804496613457,11575893118164304859,524288 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,3962910644677098576,8638445758248525335,524288 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=1584,i,14803908985554060366,826297099506699806,2097152 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3896,i,7332323719989339790,6538162792810349749,2097152 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,17835782840780226897,4563660977800027712,524288 --field-trial-handle=2656,i,17528411647960290068,9578232027510152485,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 714900c0479abed0a2437406aa26715e277210e8201519f75f6ea282802e3e32
MD5 021d06a8dca11a404cf9b507b68c7387
SHA1 bed1c3087849d67e780262c26873e5246722d780
SHA512 2a5548044900e448dc4953c71f1083e2d174a0372b0889078e4894fce43d991023132e8c05c028ec32a3ad09821bbfa40ec61d4bd3f9161dac5b660caf3a9529
TLSH
T10B716D7B3272046DEB65CC75A0C22204F5B8BCC714832DBE66A4087929DBFF14D2EC68
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586f9d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586f9d.TMP
Size 3KB
SHA256 c12a4572a4dcf48e7832356a64a4f61fcc2ed33de992a49cadee2188f7e1ad1b
MD5 5170c57516f0e4247ed168ca4091bf57
SHA1 51d8fef1e09dcf8dae9ba707b2d78721d4190b8e
SHA512 ead5045e954a03e4aa663cb7cd4cfcb573dda944cbd1696abfaf50ddb4576faf272c567abe89c8d8f5a32735ad5c6e80cb0ff7ea6b9ada1e1445ab97e838279f
TLSH
T152716D7B3272046DEB25CC71A0C22204F5B8BC8714832D7E65A4057929DBFF14D2EC68
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 478B
SHA256 8e59805fc8d4ace5eb48843dee8be7f9fc5e7f9f25d299aa76765549247d26be
MD5 e03a43f2ff252daa2e7c5ebac8b7ad08
SHA1 83ef634c7672fb18e94cc36691cc37878e25a752
SHA512 2e08cb5e22da7ed9cbcab87c75252dbcb67961c95f99cb8d7c8289a01f6e48ce7a40b5ca25e0caad9d9ca9aa1dd911f8f9c9df445b24de2fb0f6046ebd0977fa
TLSH
T1E5F09EF383E4556E8A1143F05618AF17CE2D0442431C7D55C5E4BF2B83E2075D40099B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 102164ef3275182f9319657953c70221b36aa3728341cabbefa289914edd4543
MD5 c1f8b34b76b47ac8f63a5e5a5f65e115
SHA1 1bf7f650db2a72f57be6ae35bf23f136fafe27ba
SHA512 75484155961264bd6d1c533aeab48c3e231057cdae26a465992e40e9b36ce38ed42ffe53140770b5ef6aa89a61e7d0e10a0dc7209922755de59df81e5aeef8af
SSDEEP 192:sxZI/ywFaKOMl8Mbx/fgsA0wIupM/0U6+WNGY054JfxIgrJ:sxZIFDx/fgsBYM/+G5m9
TLSH
T1DB32D816AB3469BBCCCBD209FA55BF53D5F5157292940E48A9FCC61C04E67ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 d20c77336c861f4d9c8000762b54e88c1d84276fe495f48130eb4a2338539a9e
MD5 25713e4ff28d8ee15a20323a8eee0faa
SHA1 456ad174b1c10d54348230bbae84ca600c4837bd
SHA512 7cbe318c6b01bb41226627dff8fd2be7101fb9317d2b0edd3a98db1de555ba03e1af70f53e559621d3b1883b4c8252191231e68637dbe806b17de81a86be1d0c
SSDEEP 768:7BUzXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3t/Ll/df0hxAroX:7BUzXl8pZ221WRmsYQL0u1jaKt/Lpd8P
TLSH
T184E21A3F244CCB7E4F840E9DEC266F966ED802CBA6984D5447FA894C03C67DB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 322c6cfc878dd4f8e21357111447efbc57fa0adb9623bed7092986f429b817a8
MD5 771ba81338a238bdf4eef4684f608f61
SHA1 87d1e6c6bdc8d5c2e7adf74af97850b8ac07f67e
SHA512 e76cce13b0b89554a27a39f61ba991aa0310225f32f32f98d912881e6d015ffa3981b31a7beb1a7a26b7cce05d9c085741b8ccd383cc84d6caf5e44f8acbce7e
SSDEEP 96:KgRyKyQiS+QKTqz4J04W2mCcOXxioCKaniKCeIwfi4rhOHC+g8D:AZne9hOHC+g8D
TLSH
T1D491430270BB23413CBEA90E8598879B154179633119F57B7BA844B60FAFE602DBF5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3f417a7-ffc8-4704-91e1-4134ca21eb2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c3f417a7-ffc8-4704-91e1-4134ca21eb2b.tmp
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c59e7f791fabb54204b8f8c4330dbdc4c64d2729db7a260f33653535f923fc6d
MD5 529deb3e4174046fbec7cdd477465b98
SHA1 63bd246a395cfe2f9838c83a0406d1f5efefe1db
SHA512 635ad40fd66979ee30e6c1538c33a5c05c5e0033c09efa8cd41a7b2fcf6a428f52208241ab1b69418c1d274a9bfd8aff87b1f388a0e40771f78ef45d06b1d99c
SSDEEP 384:yZcIh8NuBBjeEb7iD4K/sO0tX7O6R2FeoYwG6o3:AhZjmDL/Z0tX7TRNwZ4
TLSH
T168829D726CB8AC7B58ABE126F4073603AEB890679BC85F44D1ED7B1D00DA9D82307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 e3fc8d2ad067d7d8f7aef69ce2c859a16a045a6681d6f9fa65672f598eea39bd
MD5 95fc0e797a2cf5c1c357dabf74c13321
SHA1 ff9d6ec4d3a309fd819cc7aca12c0f7dc27a3c9b
SHA512 ad0bc834800a4ce5668767c7e0351e9352661d0eef8dd2e2ed629dee23cc0ae949a84ee016d4671f84563aa6438e21da9cb62e0d067bcedf8bab4f507592cffc
SSDEEP 384:C67FiZcIE8N+8TUNTUlIleBjeEb7iD4K/sW0ZX7O6R2FeoYwG6o3:7FQEPwgejmDL/f0ZX7TRNwZ4
TLSH
T15DA27C735CA8D87FADBBDA56F50A36039EF440A7CA859A90E2ED6B0D00DB5DC1307C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5ef8864354147fe41fc095984be54f9ccdf1f06cfb42e1a789d8272ea0a7551b
MD5 59f26b2e790a5e1e0338165af30aa529
SHA1 4538313d200e6d6a937d4018201f5414b4921d25
SHA512 8cea9a0be6509077267ae69fbc9d58770c02b0e600f47ade655afc2bd5b0f7ffc0a8279600d2655de553608fd1f50023b1d1eac7086e9aaf7b5dacb41075afad
SSDEEP 384:xZcIh8NueBjeEb7iD4K/sO0tX7O6R2FeoYwG6o3:ZhujmDL/Z0tX7TRNwZ4
TLSH
T176829D726CB8AC7B58ABE116F5073613AEB890679BC85F40D1ED7B1D00DA9D82307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8b6ce8325ad0104c63ea6ebc8a7533af841b50b668e5ab153971f90e380e4de8
MD5 181592a1026c1052f219cdcccce5bf95
SHA1 d520121620ab86a7dea3900ba3f9ca02112e0135
SHA512 017d01c5aa7d210b16f488202674dfea1e69fb157c2421e6ca3e67f609d37f6221d6799fa9140bcbd299d1ae05948204dc388c7b3a0bfb72f3319b575ae5ff69
SSDEEP 192:0GNX6fNvQmiUyiS4JML/GPTeXRsffV3Z0q75U6:0GNX61xn3ML/s3LXU6
TLSH
T1CA122B31B8A8BC7B4D93A565F0433613AEB4516BDB886F54C2ED2B1C00DF5DC6306822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d2b93dc86ddbdd890a67390b3872e7ca86d40e968f7a380acaf79ab6dfa23b34
MD5 1912e6053dd4ca73399e71cc3fe865cf
SHA1 c1604edffdefa63fc05dcadc0b1a55f90512d18f
SHA512 149d4045b3114811d33f9e7c7792fd05ea392336e239c14f9b9b0a50af6948f15fc6d798b785d3a46ec0096271fc67b8ff5c07fb13340a0a9c282fbb7625e58c
SSDEEP 192:7GN+6fNNQmiUyszH4JPL/GPTeXRJV7qQZU6:7GN+61LDzaPL/JUMU6
TLSH
T17A020A34ACA86C7BCDE2AE19F5433B275FB5217B9A951F44C6E82F0C00D759C2302836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11950e52-d955-4658-a739-b20b41aa261f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\11950e52-d955-4658-a739-b20b41aa261f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads