hxxps://cdn[.]discordapp[.]com/attachments/1547649011153109104/1547665253079457802/launcher[.]exe?ex=6aa43f16&is=6aa2ed96&hm=bb12c97410ccb3ce5bbee72b43240da41c3861eb101ec364848277e91000fc08&

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1547649011153109104/1547665253079457802/launcher.exe?ex=6aa43f16&is=6aa2ed96&hm=bb12c97410ccb3ce5bbee72b43240da41c3861eb101ec364848277e91000fc08&
Sample260910-x2tvbsvdje

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
50	3116	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3116	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335416950160025"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{0BCBB4AA-9DA3-4739-88FA-EB41F7A55DE7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 5024	2084	msedge.exe	85
PID 2084 wrote to memory of 3116	2084	msedge.exe	86
PID 2084 wrote to memory of 3204	2084	msedge.exe	87
PID 2084 wrote to memory of 4700	2084	msedge.exe	88
PID 2084 wrote to memory of 3204	2084	msedge.exe	87
PID 2084 wrote to memory of 3204	2084	msedge.exe	87
PID 2084 wrote to memory of 4700	2084	msedge.exe	88
PID 2084 wrote to memory of 336	2084	msedge.exe	90
PID 2084 wrote to memory of 336	2084	msedge.exe	90
PID 2084 wrote to memory of 336	2084	msedge.exe	90
PID 2084 wrote to memory of 1052	2084	msedge.exe	91
PID 2084 wrote to memory of 1052	2084	msedge.exe	91
PID 2084 wrote to memory of 1052	2084	msedge.exe	91
PID 2084 wrote to memory of 4064	2084	msedge.exe	92
PID 2084 wrote to memory of 4244	2084	msedge.exe	93
PID 2084 wrote to memory of 4064	2084	msedge.exe	92
PID 2084 wrote to memory of 4064	2084	msedge.exe	92
PID 2084 wrote to memory of 4244	2084	msedge.exe	93
PID 2084 wrote to memory of 4244	2084	msedge.exe	93
PID 2084 wrote to memory of 3992	2084	msedge.exe	97
PID 2084 wrote to memory of 3992	2084	msedge.exe	97
PID 2084 wrote to memory of 3492	2084	msedge.exe	98
PID 2084 wrote to memory of 3492	2084	msedge.exe	98
PID 2084 wrote to memory of 3672	2084	msedge.exe	100
PID 2084 wrote to memory of 1036	2084	msedge.exe	109
PID 2084 wrote to memory of 1036	2084	msedge.exe	109
PID 2084 wrote to memory of 3332	2084	msedge.exe	110
PID 2084 wrote to memory of 3332	2084	msedge.exe	110
PID 2084 wrote to memory of 3332	2084	msedge.exe	110
PID 2084 wrote to memory of 3708	2084	msedge.exe	111
PID 2084 wrote to memory of 852	2084	msedge.exe	113
PID 2084 wrote to memory of 2412	2084	msedge.exe	114
PID 2084 wrote to memory of 1316	2084	msedge.exe	115
PID 2084 wrote to memory of 1804	2084	msedge.exe	117
PID 2084 wrote to memory of 1804	2084	msedge.exe	117
PID 2084 wrote to memory of 4328	2084	msedge.exe	118
PID 2084 wrote to memory of 4328	2084	msedge.exe	118
PID 2084 wrote to memory of 1232	2084	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1547649011153109104/1547665253079457802/launcher.exe?ex=6aa43f16&is=6aa2ed96&hm=bb12c97410ccb3ce5bbee72b43240da41c3861eb101ec364848277e91000fc08&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcb86bc188,0x7ffcb86bc194,0x7ffcb86bc1a0
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,14199454702764488984,16652654797348685286,524288 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,14140544782299914298,9827249584153126548,262144 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,15053402669929108512,10761449898566824456,524288 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,12063594524265187995,9280170770296859811,2097152 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,12426155728805009257,14165075111685914654,2097152 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,14826680510684180413,2962271284774637210,2097152 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,8151581120934639626,15489928805166789503,2097152 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,10406183203733085014,17553909543982622252,524288 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,12199721638836601111,7344139190335659351,524288 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,7294168579199047567,18164873045450790631,524288 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,7294168579199047567,18164873045450790631,524288 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,11124693520365546356,1810748037062901313,524288 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4776,i,15430839475272102444,1760485509082764637,2097152 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,11893229391294238239,1120630203125426769,524288 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,17483328091301326050,14859672090759017808,524288 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,1707539677992622594,9322245599451744854,524288 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,1758271212601218357,13153263946077042305,524288 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,3630460164505268768,8705759482246159684,524288 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,11326926644767016786,8566593016184730370,524288 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6100,i,17462331971858135090,1048496884810411536,262144 --field-trial-handle=2352,i,17418225297335979790,9547007322386244892,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2dc7a0182c2cd470ce2a84e1dfa5f76a32f7de7f1e277e611fd5c327a65a461c
MD5 2a8304c2281f7ce8d84c1d62fb5e6041
SHA1 2147551a25e8d49951a9d0d28b06c130c8e99be3
SHA512 dd3eb7fb0ad4a7897bd0c37dfcadc4e137bc9e87431fcbaab51d27b0a3d9a115bc1db026eb4c1779c7dad024fa1ec017a243f42fb2d85e69214ab73cafe347bc
TLSH
T1E771270C0112CCD1E3E256F1C0F2F245B4B0B2AF3B779AA12274C5BC6519F726369C0A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cc05.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cc05.TMP
Size 3KB
SHA256 9b227c9cd68a7d875349770cba9b253eeb84009e2681f69b25e5ea914722fe73
MD5 63e8394b0c2493f874bed65c4734d672
SHA1 ce99edbcc7cfa70c9bcb708b37f9648d56aabad9
SHA512 2937f2c9f3445850d616f26c74a9c29460abc0c7ac9a9841852eec83fd89b2c3267f89b09697385eb4c68dcaf5aba07efe963c749405b78453525a22616d033e
TLSH
T14171160C0112CCD1E3E256F1C0F2F245B4B0B26F3B779AA12274C5BC6519F726769D0A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 808703bb1af0cef292a22ccfda106a997712d91922d6e38a0271095958d0afd3
MD5 b32440e9fa694598009cb22802f887a7
SHA1 ac0faca507db637143950dbed946e155746d0cf8
SHA512 aae717f1ecf119c3872f38f4ce47d2602a342439c32a2e011633acd2977e6e045197ff9858eff618bddf178c66165e483c29eb495d4859febc798307c67b3fd0
TLSH
T128218EF387D5865EC95616F06A247E1BCE1D051443183C1A89D4EF6BE7E3472E102A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cf0a83bcb930a30cfe4a9d27929fe5a580e7a9da3a21645881be30a5848cabff
MD5 cdc975470ea1a8bc10654c8d6f96e2a6
SHA1 65de2e93aa5cec3fc2fe2a1d90265a5d0534d129
SHA512 4930a002d48965cc4265fb713314d5da2adaf05eccf9a2af16306802622814eeb08528a7764d60b367c13dc84382966c5ad3d907b576bb1e2a36c1ef821de391
SSDEEP 192:sxZV/yM/jK1Ml8MWP/fXsU5IdpJHW6+WNGYLloY+aIgrJ:sxZV5uP/fXsUSJHbGO59
TLSH
T19942F8116B346977CCDBD209BA51BF53D5F94472A2900E48A9FCDA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 45897bf6a3b6dfe18f288f1745c485ad3c26f1d1ddbe94c9297ffb48eab6b668
MD5 de09456c549121a71abf9467d17061cc
SHA1 fcfe19a92868c13d84951c4513d03200a7fc647b
SHA512 7177cadcc7f400f196543b0382708eae1fff99abf686b93511853cbc807a804f83e97cc462d18523357430479abd2ea537802ffb3393a729cec3dd76f906d2e4
SSDEEP 192:sxZV/yM/jK1Ml8UQanP/fXs65IdpLHW6+WNGYLD7B+aIg5cJ:sxZV5q4P/fXs6SLHbG+5G
TLSH
T15B52F7156A346977CCDBD20DBA517F93E6F94473A2500E48A9FCCA1C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f6d817d099ddadad4224e984e265cc8d21f3eaed62fce453b8903c0ad39871dc
MD5 ade3ed3cf4818e76479f7bfd255a15ef
SHA1 735302c0a6dcc32ffe86511f2e53097baea9a2d0
SHA512 e01c6741cc88d06be0e25ebbb60ab7ba1669131ecfa1a98f07c6c909ca95e86592a03d4cf28eb0346f64d079ce85a0c83483f799b2f6c9c0f33e807d78344fe0
SSDEEP 192:sxZV/yM/jK1Ml8MnP/fXs65IdpJHW6+WNGYLxoY+aIg5cJ:sxZV5vP/fXs6SJHbG45G
TLSH
T16B42E7116B346977CCDFD209BA517F93D6F94473A2510E48A9FCCA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9506facd9d1b1af0bb8b6a9078965aa088cd1b3a68e533c3f1d5536acc40dbfb
MD5 17f2220d8db3912c469dab1875f1fc7f
SHA1 2de044f6e14e55220c36f4de59dae60891323362
SHA512 6d071134c74e189de1d4fbd378f48c300fb1609d8e19f5de761dcd5a725183da6fd48c04bebfc11272d8470f3f1df387aab099fb60b6d2b905438ca740321bec
SSDEEP 768:3zs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNsro9d:3zs6pD1WvxzWju1jahILIsN39d
TLSH
T16FD2FA3B680CCB7E4F841E5CAC2A6F967DD801CBAB98899447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 5cf18434488f7e4cf2027e92dfeff5a94980e43b2640610b4b06f8c9967b6b55
MD5 a4ef626a457b2a694a58b8c373b523bc
SHA1 4a62ed2516b908e829af45cba91d8d689f6fa64a
SHA512 f2ecd4e8d9aa27bf432c6dc2d84f5b2eff370a7bd05849b26e0ec4ea946c9b42c0ae3d34a5fc6c3da6ff53fadda3755eee49f584031babb08fd1ac50c69a9a58
SSDEEP 96:KUAAKtePONWKuYKaq4KHqQhyKiQCWByKCkG:ii9J3aJxH
TLSH
T1A5E1011232BB02533D3E691C935987676F427AA33418E42B37AC10B24E66E345DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3a36475-08a5-4941-abde-dc11fa07a6e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a3a36475-08a5-4941-abde-dc11fa07a6e5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b0773029d70951842accc55a7bed06d5d30763c2a47c02f6a363786ef78c6218
MD5 09e5b48a16b280497d55eebe5d817797
SHA1 5a4fd7f76793a9f587d161a8bae962932391058c
SHA512 e59cf8d935ae2b631de62cd478df35b770056bb52f761554e6774990e9024202998e051f1822a21793ca9e796e7113a6f9bc526137e125e53ebf94b95ec27ee0
SSDEEP 192:uoLsNNUBQg76Qve7+3vV2QmiU1tIK4atb0h+FdPoYRh2veLM9rq09CwqLq:BsNNUBR7dF4gVa9ndQcM/U6
TLSH
T19542293168786C775DE7A546F58735038FB4806BDA8A2F80E6EC9F0D01DB6AC2307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2072410b26977d34e249e0a4fece24a211920b44e79cb7f7c1bf3cfff281792b
MD5 6bbb6edc42a3b894616181d0ae8157a8
SHA1 f033c67d9b2469f83993fc5a09c078f57ff31549
SHA512 15788ceb6af7d15937981506b3a1141231be632092a657b0786679a42ec068935399c79fe7ef10292fa61c35148b9c968665794ae75d82c5334774a3fcba71c1
SSDEEP 384:LiFiZcIQsN+8TUNTUlIlvR7dF4gVa9ndQcMGU5oA:mFQQTwgP7dH4RG2U5X
TLSH
T15E926E325C689D7B6DFBDA45F98631038FF48067D9D6AA80E6DC9E0D00AB1EC1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d97fb06ac904d60398bd10fa86bdf2d769119d097ef3298540e5010a5876d42f
MD5 0c63434b19aef8620d65145063826868
SHA1 a3f182c34164c55a88af732abaa9e6c46c8c041a
SHA512 a8981ab616abf7207cc87659983aa5c69e116b55fca3d9c2ba0dc9a6746379b66f8817272bd43feae15f8fc6634c46659669345a65033b36057a2b240172be58
SSDEEP 192:qONa6O7+3hQmiUyhzGttb0h+FdPougGmCU6:qONa61+Gt9ndQwNU6
TLSH
T11302D7396C786CB78EF3AD46F68726174FA8117BE9962F80D6E85E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 05b1b4f8cbde0308b364c72fadc508b2cb5a8381a73e4409d21b2d6d73bf138c
MD5 788447ff2694b6aeed31ac1d5961e5fe
SHA1 d6148ffbb84a59493fa9ccb03620639d409be325
SHA512 cf03fc5ac10d97a3720e77228a3304c723f9af679dac3fe3b445b12ad91aacee7d19bec58b43b033f2d94a385a9401c06206bd90019410743240518a513b9cc5
SSDEEP 192:RONX6O7+3hQmiUyQznttb0h+FdPoYRh2vVcN9rq09CU6:RONX69Nnt9ndQcMKUU6
TLSH
T1EA12F8356868AC675EE3A446F58735138FA5812BEE8A3F80D5EC5E0C01EB66C2347817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 22a1bf2b91084bb24cc57b8baaf21d43c9f920016622a76fa94e2df1c6166013
MD5 5cc0e3f4916bed9dbe8a577c64a6d7a9
SHA1 919995c982b3f1bf83c5c3d1671aebff67e80f3e
SHA512 81bad02e8f26f2417f41af32e2150104e49096a93af608ecf6468a877a3379ab0d0e1dc006af67b2eb2194add0ada2435dc62f5ca7b9892c64a1c3d7c8ac95aa
SSDEEP 192:uYm+xasuheOwQxMGsNNUvQg76Qve7+3vV2QmiU1tIK4atb0h+FdPoYRh2veLM9r6:SZcIhsNNUvR7dF4gVa9ndQcM/U5oA
TLSH
T131725C316C786C7759F7E146F98735034FB89067DACA1B40D5ECAB1D00EB6A81317D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76bb25f0-fc3d-4fca-a58f-8984c9ca643f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\76bb25f0-fc3d-4fca-a58f-8984c9ca643f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2d88168874cd57dffaac474e3dc556a85244e55c079a279ba55f9d29512b6542
MD5 8f6c14b7cadc736697a789708e4e0838
SHA1 4d9dcd32718cf9d92bee2afae37afdc03175c587
SHA512 5b1f99bbed45c27e3cb862ea1f49c16493dade60c3af94216fa9d14da72850f6111241183a34fbd174c7832b0e6ab8ee019624bd458dd1372e50bdbc2e742073
TLSH
T19C412458B6F90148B3B76F569BF7A46D487BBC332E0AD09D00110E4E0762A80C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download