hxxp://uniqisland[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://uniqisland.com
Sample260910-ssfh5a1gma

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3896	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335273908309803"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{E5ABBCAF-843C-4F15-A778-7703E6E0C61C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 4548	3492	msedge.exe	86
PID 3492 wrote to memory of 3896	3492	msedge.exe	87
PID 3492 wrote to memory of 2320	3492	msedge.exe	88
PID 3492 wrote to memory of 2320	3492	msedge.exe	88
PID 3492 wrote to memory of 2320	3492	msedge.exe	88
PID 3492 wrote to memory of 4172	3492	msedge.exe	89
PID 3492 wrote to memory of 4172	3492	msedge.exe	89
PID 3492 wrote to memory of 3308	3492	msedge.exe	90
PID 3492 wrote to memory of 560	3492	msedge.exe	91
PID 3492 wrote to memory of 3308	3492	msedge.exe	90
PID 3492 wrote to memory of 3308	3492	msedge.exe	90
PID 3492 wrote to memory of 560	3492	msedge.exe	91
PID 3492 wrote to memory of 560	3492	msedge.exe	91
PID 3492 wrote to memory of 3924	3492	msedge.exe	93
PID 3492 wrote to memory of 3924	3492	msedge.exe	93
PID 3492 wrote to memory of 3924	3492	msedge.exe	93
PID 3492 wrote to memory of 4392	3492	msedge.exe	94
PID 3492 wrote to memory of 4392	3492	msedge.exe	94
PID 3492 wrote to memory of 4392	3492	msedge.exe	94
PID 3492 wrote to memory of 3324	3492	msedge.exe	97
PID 3492 wrote to memory of 3324	3492	msedge.exe	97
PID 3492 wrote to memory of 4724	3492	msedge.exe	98
PID 3492 wrote to memory of 4724	3492	msedge.exe	98
PID 3492 wrote to memory of 4704	3492	msedge.exe	100
PID 3492 wrote to memory of 4120	3492	msedge.exe	101
PID 3492 wrote to memory of 4120	3492	msedge.exe	101
PID 3492 wrote to memory of 4120	3492	msedge.exe	101
PID 3492 wrote to memory of 4996	3492	msedge.exe	102
PID 3492 wrote to memory of 4996	3492	msedge.exe	102
PID 3492 wrote to memory of 4996	3492	msedge.exe	102
PID 3492 wrote to memory of 992	3492	msedge.exe	103
PID 3492 wrote to memory of 992	3492	msedge.exe	103
PID 3492 wrote to memory of 992	3492	msedge.exe	103
PID 3492 wrote to memory of 1716	3492	msedge.exe	106
PID 3492 wrote to memory of 4160	3492	msedge.exe	107
PID 3492 wrote to memory of 2276	3492	msedge.exe	108
PID 3492 wrote to memory of 2472	3492	msedge.exe	115
PID 3492 wrote to memory of 2472	3492	msedge.exe	115
PID 3492 wrote to memory of 2472	3492	msedge.exe	115
PID 3492 wrote to memory of 4776	3492	msedge.exe	116
PID 3492 wrote to memory of 4776	3492	msedge.exe	116
PID 3492 wrote to memory of 2796	3492	msedge.exe	119
PID 3492 wrote to memory of 2648	3492	msedge.exe	120
PID 3492 wrote to memory of 2648	3492	msedge.exe	120
PID 3492 wrote to memory of 2648	3492	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://uniqisland.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff8026cc188,0x7ff8026cc194,0x7ff8026cc1a0
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,11572835759807533482,15670963884377941164,524288 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,7116250522705723308,4212345456959020445,262144 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,11296520109459559409,16051628239477775250,524288 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,12223572212653883631,17662777706955403763,2097152 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,11797868210214655161,8500332242869197140,2097152 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,2852403824648189555,10571816622520443410,2097152 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,13762807446159407950,8483691486416216187,2097152 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,18323116540981662061,2830894920314168164,524288 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,14318103068958449259,14445323109436421801,524288 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,9044597417776926041,7287610892655203803,524288 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,9044597417776926041,7287610892655203803,524288 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6236,i,17005992266639901846,7649605005323539616,2097152 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3564,i,94696039471856378,14907552428879343204,2097152 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6248,i,13064545122523523535,17593065990314051853,2097152 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,13613677661471549991,2501710677464543170,524288 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,7302000668975077577,875579637929080347,524288 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,11581260541042581078,1946074149931993750,524288 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6184,i,7154195307429977193,14493903704838621162,2097152 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,430778057754756952,15668628231097413064,524288 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,3514114335782444752,1505512130670514805,262144 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=748,i,7160426388397232695,17966408003279110070,2097152 --field-trial-handle=2224,i,17710038573746900001,16587444030745135223,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:2648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a24ad74ecf9398166b9e3dc97e5aee80c835866b7d3a8437f367f14d56dcd670
MD5 2cf7b5118e24a0ae96f5df78c76f1c05
SHA1 3af1a72775037c6cf0a735eec04bfaa450246594
SHA512 f71a8e63fbe41026a2e831c913b48b3d294090c3e6caa2bf07085bd2c3ce9b0bd73dac0f80f2c613d25e0e604fd624e19429776f8e3e398caef2513fdc2e5d20
TLSH
T186617FFA061224A3E72C8270E4E38A153677C2551EA72E46CCBC867D79C7F50FF69149
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 922f04a210cfcf2909f52b46deb9466f685a7e386aa46356303a32e5989bdbdc
MD5 9a0d56ac2ce0b81e0ac8f490e24c1f9f
SHA1 875b04c5fe6a1466982d0d4be95d2ba3f4490bfa
SHA512 30316db32ee28bf5dfd015aed853467ea34b4b6b8aa02ce8772bbe07acb2e9c070115e0033c21422e7e55a89c2088a4e5c92a58f04e30be5b96330e3d3fc760c
TLSH
T11111BAB3C7D585AEC90116F06A28AE2BCE2D0A06421C3C19C9D4FF2B93F3475E10296F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9f8fb2e028bd03e95421f70e49cfbfe7b1c3138a5e3f4298cb800a81147fdd6f
MD5 d31ab1fce507af47557cbc5bfd4b5789
SHA1 e20b85bf8b6722804143c458844b0436fdd7d140
SHA512 a66046733d29e6ba971345898439dcbd275d9d1c1472ae9d3ccad2d1965e9099108d6a0823310180a525aedfa999b4c60e26f73ebc1505ee5bdd24be817a3a17
SSDEEP 192:sxZJR3yM/jK1Ml8MWP/fdsFhFIdpRSSHbr6+WNGYHjM6CIgrJ:sxZJfuP/fdsn21H0GR9
TLSH
T15B42F816AA346977CCCBD209F945BF53D6F95572A2900E44AAFCCA1C05E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4ef8b2b881574d9e52140dbb70f39e3e38ec5ee633ec4429a7e3bf77789b8d08
MD5 762fe6adee74623fdf05813b9a48ca12
SHA1 6bd3c8ca729734462a4d0c48fb2f830512ff13a0
SHA512 cdbc042ca38838baf89f3ebe9dbf93078ac84da3d012db96058d3cc62c91e7ceacc0b7e94dd70944e5b2beefbebae36cb37ecea34417732f10fe43095c004962
SSDEEP 192:sxZJR3yM/jK1Ml8UQgWP/fdsRzFIdpz1Hb/6+WNLyy/YH37SCIg5xJ:sxZJ5q7P/fds12BHwn/EZ
TLSH
T1B152E816AA345A77CCDBD209F941BF53D6F9557292900E44AAFCCE1C01E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 febbd30c57e3665483c169fdba52d00ed5c656fc9953891d3dfb8ba3e8c833db
MD5 43bb4df5b990d8219aee8f1e170095d2
SHA1 0ad437723a4832e02b3e2af85ed6771a2ca7a733
SHA512 8780dee035348d1bff43dcb9f349b57384471390893cc4b11add24c04b98abfd01a57cde0a189a94faeb4b22926ad582a8c924c54ed574836e3df1b6e19ca7f4
SSDEEP 192:sxZJR3yM/jK1Ml8MWP/fdsRhFIdpR1Hbn6+WNLyy/YHDM6CIg5jJ:sxZJ5uP/fdsr2jHon/Tn
TLSH
T1E1420916AA346977CCDBD20DF945BB53D6F9557292900D44AAFCCE1C01E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 850fa1715495f0cbe25865e1baeaebf0d3ba2375fa805a05389099557a887dd8
MD5 3d03dfce9e14690882a596a3501d19ca
SHA1 7a37540488d1c6ec8eafc4b2ebdc6b2296b9b4a8
SHA512 70a0b2fa30ebf376765b012da6d9c4622a1c35a26df6a9116ebc1b23da0125ce5b2c6fbced9434688b3edf6bb686fc65aba8798e7d1bde6d14116e7719d9e5f9
SSDEEP 768:twUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RyroVuC0rxN:twUZYTMWvg0Pou1ja7eLZmRpsb
TLSH
T109D20A2B280CCB7E4F844E5DEC266F963ED801CB5A584D5447EA894C03CB7EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0217ae35f3023907e8d5adac854a603171d8ff24339eabcd2b2a2fb23bf4622e
MD5 cc62c7b9a9a74c28dd96ca54561fb684
SHA1 054c0f80babab11b8466dc330d525a4454d0eb04
SHA512 0c6402528e54e27c5821a2b38a6eed8dfc3706912bcb5eff7681fb4cead68e7c0271543f4dcc4020fa119129f1e59bf5d475f5d0f93d988d955605be503470ff
SSDEEP 96:KA1eK2A84YKR+Ou7KKsk/LqK4gyufOKYArz:EWX5JB9O
TLSH
T1ADE14B5A70BA02423C7D2A588394975A8EC675633028F42B7FAD01B14E67E31DEFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c640b40-48bd-4add-b19a-6a332d7cd3b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5c640b40-48bd-4add-b19a-6a332d7cd3b1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 62696c0134bd3dc684a134ed78c6c715dce32563760ce78bbbcca5623dab121d
MD5 0f62569af445827ad51566a199ad25fb
SHA1 e4c3da0789d21c57fe0edeb4f7eb5593ced23693
SHA512 c3bf8d6a184ce3016a3a64a86505dd76276ddd6d5185d849f5824353d6f9b2819e6193024e46c32b2edd5a294af93525077f5fa4ee017ecbba0e0cfb34b209f8
SSDEEP 384:pZcIhsNjT211x2zX5od+l8yBX0d+20Psa+VY09oA:hhDqO+cl0Phgv97
TLSH
T147826D326964AC7659F3F285F84B32135FB89163D6C86F9482EC5F1D01AA698131BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 b1581345a62ced58d7658c556ccea494178c3e81bd1192cef19c2671203b0792
MD5 8ad5a799f80ef6dd149c59868b8ea4b4
SHA1 c09c15b3b20cb875aaadbc4bb432cea7477f8e36
SHA512 07c02fd2428bf226fe951f09b3d886866c1984b91f6a4fa013ae2499e9e381d10fef42d3a675688909b3e10a9fa76950a7831043369d4f88fd9913ed58e66834
SSDEEP 384:GiFiZcIwsN98TUNTUlIlq211x2zX5od+l8yBX0d+2oPsa+VY09oA:tFQwMwg/qO+cloPhgv97
TLSH
T1FBA23B3358589DBB9DF7EA85F94B32138FB451A3D688AB9093DC5F1D01AB298130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e213f9e78433909b088b801b6bf9ca94be26d2350a41b15e193a86850ccf56d9
MD5 bb980cde5afffc90d619cee57a2e6948
SHA1 14a21b41e570cdf0b79fdf69ac540eb87ed6b672
SHA512 2f085c2e8b0cab9fd9d8a5acd6d3938b5d72ededa7a045422fee2da13168223302541d4ea3d3a713740589f4469951a7aba3179ac6ce29c256cbdde3bc57a4ec
SSDEEP 192:yON261VWQmiUy3ygGX5Obd+j9jzoryMmM/a03Q0U6:yON26WDgGX5od+l8yZD0U6
TLSH
T12C02C83568687CAB8EE3BE49B48737135FA4217BEA946B84C6E81B1C00D765C2347C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d934d8ac491ac7b3568d6b3b740402c2288144ccd25e2055087cf6f1396c5181
MD5 93e0495547607e34ae67b46641efb597
SHA1 39dbc0e01d3d706fec06abef70a8ce8846d275f6
SHA512 3a536ac70d6a46e294a260f849df1d984eba05d2ca9f9459223592b16bea94e46e926a7d08bc9173bbe716dc043f6deee6758346b28fe1a402efa264cf48761e
SSDEEP 384:pZcIhsNjq211x2zX5od+l8yBX0d+20Psa+VY09oA:hheqO+cl0Phgv97
TLSH
T1C1826D326864ACB759F3F285F84B72135FB89163D6C86F9482EC5F1D019E698131BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 58e982949db928e30b1f5677bea1bfb711d59eacbe17978bd326a6ac996b9990
MD5 a79db0bab22188bbf5592370bf64ab31
SHA1 253e0fb737e85c59a51fe8284d34fa979abe9321
SHA512 c20e92c4597798861f8a05e91ddf8744aedb975890baa0508294b07e3febf10635625c9ec3314c6d96f7ef7a8b52e5ea6eea1d73bbe5946f0dfaaecdf6d86f7f
SSDEEP 192:+ONe61/WQmiUynyiGX5Obd+j9jzoryMmLXQFd+2tjJ2qzU6:+ONe6g1iGX5od+l8yBX0d+2fPU6
TLSH
T11B12FB32A468BC679DE3F545B44B32135FA55167EB886F80C2EC1B1C02EB6AC135AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9c2c6b56d1556c94b278b2d50483dded7ead010450df4bf6e4357deb7c724185
MD5 cccee341dd6d8f9a00be6839b4eef922
SHA1 b4ba244b416ac5e671d8443fd64b0fef19831fd2
SHA512 150e0d1d2bd35563b56a7dbc3cd7e3016883ef4e6a14757861bb38383b5259d6ed7b6eebf4ca6a9a4f326ec4c4cb7a13a3729328043a4c165ee7357e8e903259
TLSH
T110412B58A6FA1148B3B7AF5A9BF6646E447BBD732F06946E10110E4F0A23B4089B1737
MD5 SHA1 SHA512 TLSH

Submit Download