hxxps://aizyfloor[.]pages[.]dev/

Analysis

user interaction
yes
max time kernel
268s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://aizyfloor.pages.dev/
Sample260913-s8lp3sygpf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337880947994122"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{57B4967E-C31B-4C87-80FD-56103354DCE6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2024	msedge.exe
2024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 4936	2940	msedge.exe	89
PID 2940 wrote to memory of 1708	2940	msedge.exe	90
PID 2940 wrote to memory of 2816	2940	msedge.exe	91
PID 2940 wrote to memory of 2816	2940	msedge.exe	91
PID 2940 wrote to memory of 2816	2940	msedge.exe	91
PID 2940 wrote to memory of 1732	2940	msedge.exe	92
PID 2940 wrote to memory of 1732	2940	msedge.exe	92
PID 2940 wrote to memory of 64	2940	msedge.exe	93
PID 2940 wrote to memory of 64	2940	msedge.exe	93
PID 2940 wrote to memory of 64	2940	msedge.exe	93
PID 2940 wrote to memory of 3584	2940	msedge.exe	94
PID 2940 wrote to memory of 3584	2940	msedge.exe	94
PID 2940 wrote to memory of 3584	2940	msedge.exe	94
PID 2940 wrote to memory of 4700	2940	msedge.exe	96
PID 2940 wrote to memory of 4700	2940	msedge.exe	96
PID 2940 wrote to memory of 4700	2940	msedge.exe	96
PID 2940 wrote to memory of 920	2940	msedge.exe	97
PID 2940 wrote to memory of 920	2940	msedge.exe	97
PID 2940 wrote to memory of 920	2940	msedge.exe	97
PID 2940 wrote to memory of 4424	2940	msedge.exe	100
PID 2940 wrote to memory of 2520	2940	msedge.exe	101
PID 2940 wrote to memory of 4424	2940	msedge.exe	100
PID 2940 wrote to memory of 2520	2940	msedge.exe	101
PID 2940 wrote to memory of 4704	2940	msedge.exe	103
PID 2940 wrote to memory of 2636	2940	msedge.exe	109
PID 2940 wrote to memory of 4476	2940	msedge.exe	110
PID 2940 wrote to memory of 4128	2940	msedge.exe	111
PID 2940 wrote to memory of 4456	2940	msedge.exe	112
PID 2940 wrote to memory of 4456	2940	msedge.exe	112
PID 2940 wrote to memory of 2024	2940	msedge.exe	113
PID 2940 wrote to memory of 744	2940	msedge.exe	114
PID 2940 wrote to memory of 744	2940	msedge.exe	114
PID 2940 wrote to memory of 3864	2940	msedge.exe	115
PID 2940 wrote to memory of 3864	2940	msedge.exe	115
PID 2940 wrote to memory of 1544	2940	msedge.exe	116
PID 2940 wrote to memory of 1544	2940	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://aizyfloor.pages.dev/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa7ecac188,0x7ffa7ecac194,0x7ffa7ecac1a0
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,9722402956736150770,3129361116429005164,524288 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,2595088517739362830,14460791839327968465,262144 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,2948504748072540269,16256490030372487527,524288 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,14930079599611663347,7894371275163443482,2097152 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,7715247823163702659,4612131046194722603,2097152 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,14175551812508708453,6779730674213355224,2097152 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,14519218011122692134,9531269561277839954,2097152 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:2
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,14290228199183296013,6011610726855226400,524288 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,8331181424122232085,7145483160837508445,524288 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,13309022895206984464,16824814602042559373,524288 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,13309022895206984464,16824814602042559373,524288 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,4204077013036815280,5470215839843178945,524288 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,10067179575095012549,9473551102966504178,524288 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,11819848593848811578,10973118694724411804,524288 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,1901393526218665068,11742164494564252946,524288 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,17406921831716024465,12879667572875501235,262144 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,9490541025372833830,9715687949729344767,524288 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=1508 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,13693013537198829551,17221855347988717855,524288 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,1576262045562282026,4936006724680542631,524288 --field-trial-handle=2340,i,8074160779550665078,9249738893933947842,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d7233a69b90d5b188f22dfd7d283d5161ad0ff8a51d6e4546502cbb333227186
MD5 5fec695d5236930f1f5384915d7126bb
SHA1 c59eead1c22f39725034cd445f4d4c0dc2b84d28
SHA512 60a5571076222b0970a64e8257f5ff62d7566aeec4297a399a6b585312a3f5526bc8bb702bd276c8aa52977158670f4942cee8366d0ca2ba941b407ef3f04973
TLSH
T1DF615E415A8044E7E7B97538BFD5229F3E375AF043A3ED051DAEC87DAB0A31B524E242
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6875a8868e0da6fd90f1c1d569b8754f63d55d5dcabbf512096405dbe401b69e
MD5 d0ade5c6948c812ba822d672d8f00f6f
SHA1 3dca04a6ea091f6db6349a0c785fedd9e7fb4fe8
SHA512 c8900696358eeac4e0f12eb32cd74331f057a34d336b96d6392ede50839f8095ccac91faaba6ef12d0733a683b3f83f6e0b672f63e407eaefffcddbe759297d2
TLSH
T13D519AF6C2D9856DC90252F46F24AE2BCF2D095583283D0AC5ECAE6FA3E2471D21654E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 998c0ba24e4bf5f412e38170e12f5fe5b59d2c24ba8f493cac5a219f93cd8864
MD5 ee93f6c9f4dc0c3cf3cdc7a4cd75f018
SHA1 37db13e219f86a7f2561a74ed4aac4ae76381b25
SHA512 4680a6e38ecd31cc53771402daa8dc795bc91de38e24b9127e9b0e19a4ff758e2f6aa6e3f2df5dd68f0282cbbe0e0d4de44826529ec5cbd849f6418ff6bdfa6b
SSDEEP 192:sxZURmWt/fmseqWIdpT0HW6+WNoyc/Yg+ecIgrJ:sxZUXt/fmspXgHbK/y9
TLSH
T19B22A6526E28A97B8CC7D20DBB15BF13D6F9503265D51E48EAFD861C04E7ADE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 00140cf1d10568b57b6a8798e67da40bc17d0610e6685e5adfd48425eaf44134
MD5 785cceac8502b8c5d82b656a751201bf
SHA1 2e0d16335ea7881f0820cd2c4ef6de353c3b2711
SHA512 0d77bffcafedad4278aee61e9d4ae8d3fb119d132df200566e44aca219ed79eac47fceda24014c989d4754df00520dcbdfc0b83058dc6ed07ca58d0d25d37c5d
SSDEEP 192:sxZURmWt/fmspOWIdp50HW6+WNoyc/YgCecIg5AJ:sxZUXt/fms4XiHbK/2G
TLSH
T1B222A7526E28A97B8CC7E20DBB16BF13E6F9503255D51E48AAFC861C05E76DE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d8f0077a20215821b8b821733c5b08c1b4facd2792bbff66c3b0f26349a0f3f8
MD5 f76e339f347a7bce1c1791646908fd54
SHA1 58fa64530213344afe3b61448e1de8e80c85bf85
SHA512 fd96f480596f54ac0ec3bd0a1d97d7a5c74e735f371905b27bda60e42bcd3355d0f6cba0119d6351ba4fef1ee7f7af8ab4b40de37c5b24c3083ed9c90a028ead
SSDEEP 192:sxZURmWt/fmspOWIdpT0HW6+WNoyc/YgEecIg5AJ:sxZUXt/fms4XgHbK/8G
TLSH
T18C22A8526E28A97B8CC7D20DBB15BF13E6F9503255D51E48AAFCC61C05E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 e87bd6ea11da3918f255e67a45f2326d2a427252abeb6ace226fabe4b0f95677
MD5 c1bb14c44b94f89eaa2f790ed08480c2
SHA1 3761e02d75545ecdfdc63c626598ac2b0bff8168
SHA512 b9a3a5d11ec949ddc9ccd7796a8a9153427f0c4f211e79aee6708e14c2e506f17524e887c3e0a38a23e4b4fe4dd3306aeb376c4079bc46e8618a2b85b02615b6
SSDEEP 192:sxZURmWt/fmspqWIdpT0HW6+WNoyc/Yg+ecIg5qJ:sxZUXt/fmsoXgHbK/yM
TLSH
T17A22A7526E28A97B8CC7D20DBB15BF13D6F95032A5D51E48EAFD861C04E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d3ed2e13b690878e2e02c76e83d1a09575b077c8ed1d8644b35b203ddcbb5846
MD5 c357a0fec823a83eaef44d5f63631f1b
SHA1 4b90a79958580b258d14afeb3790c164fc48def6
SHA512 cef0726cc59d128c6c7efb3df0ed86355b65a18cb5464aa5f487734555d3edf1eb8b7225fcc19757566307436f21c0ec0d48230ed778fa58ba3f5f358ba9b4ca
SSDEEP 768:PUichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzUro9COv:PUichfPWvPZplu1jan+LKgz/QOv
TLSH
T14BC2FA3B644CCA7E4FC01E9DDD1A6F9B7E9802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2f2ef02b6085c5e2137aca1f79be4c289d78a55954f88d6f2195f90e9e733988
MD5 e7f803b7a9e82cb5c5b722e58067f64e
SHA1 a184954aa4b5618096f0babc33007dabd0c04d38
SHA512 00964c88edeca02229874c8c56330844f4e93d7ab4686e9e5518bb943ea74181906da9a5994a4d224caabd917128c5d055149776904b3962bb48f0dd54a53ff0
SSDEEP 48:K0bef7F99ebtAFISbeK9r1pexzOYo5L/yLnKzHJp5Sbx8hISXSK9X19SxXCY0l9V:KcooKByWSYwK1aaAgK16SQ
TLSH
T12D91131530B7025039BD344D91B28B2E924272B33219F76BBBED04628D7BE554EFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599810.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599810.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5a4239efc405cd5abbe5169235bfdfe2aeaffd7735729ee03c740e9fc3226feb
MD5 2b6230cafe5de6e8bc054805eec2dca5
SHA1 c63bd57eac593424bf50ca06c7fbbb221e7a12ce
SHA512 6ef3ee220b20ed2f7d9a665b1712929c259fd2fb6925f19b656f1ef2fbaf2b907902e4fada23e9117456aa8c85de59d0be997621b387440fabb59e4e878966f1
SSDEEP 384:JZcIesNt/e35hFeBGYX5EiOszVJ6sa+VYLd7UboK:Be5NoGYuiOszT6hgOqR
TLSH
T170826C7259B8AC765CE6A691FD4B26034EF89117A7C87F9485ED6B0C04DE298030B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 115a88d73ceb761a18abecf3691dc9d1ef0f8401b861ece619cc95c8c91334b0
MD5 331248c72d78e2c14523aaf91cf34044
SHA1 c738f9ddcdff96488e85e9cd0fd5ca18238fc9a6
SHA512 9882f678911cedd71959cd8d9fb58f7f05a0e7b179bc539730dd6bd7192541d38f93fbe4aba8cf12e0c6f86480442aba2ed88b2d9b9a14d7f27dcbc7370a55c4
SSDEEP 384:AiFiZcITAsN38TUNTUlIloe35hQeBGYX5EiOszVn6sa+VYLd7UboK:bFQ8GwgvooGYuiOszF6hgOqR
TLSH
T17DC22BF248E79876D89E5743BB7E2D034DBCC157B6846A54B3D85A0CCC9A1BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4e287e2efb889686436741032c49038a053241bdee69f56ed332ed29a63fa6d2
MD5 faf07e9bcf500e73ccb32604d365aeaf
SHA1 9348a61e2ae2a2f26cdf25bfdb6e8734f36936f9
SHA512 0c127bfde17eec5cc51c333b26e14817fd653eacf6efb0389d4928f1786bcd8e16c0abb651d3bf2b42da6602c25b11e08777424dc886600c4593527e0b3dc4dc
SSDEEP 192:LJON96DphmqQmiUyZeq8wGYX59ezrCOsFkk747U6:lON9619fRwGYX5EiOsJeU6
TLSH
T1FD02FA39A8787CBB9DE36E45B48B26135FE8112FA6906F44D6EC1A1D00C768C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b85f58d8104d4ea19041b7418e7c81ac9c2b6c539f67b72248ff15a7cbd5a06d
MD5 e72e2f156dfb61d1f289eacef2c9e066
SHA1 060416289d00fb9307b2d7450b36922061e4a95b
SHA512 0b6b9957b9ec136856af29c80e13dd6d68c79cdff4e906d435616550c0c980a77c1ed506f793435a0d78e18566030c6dc9d891e324817059b4daa769c79a2fa9
SSDEEP 384:BZcIesNtoe35hFeBGYX5EiOszVJ6sa+VYLd7UboK:JeUNoGYuiOszT6hgOqR
TLSH
T1FD827D7259B8AC775CE6A691FD4B36034EF89117A7C83F9485EC6B0D04DF698030B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7b5149399be4a985007e2e54862655da6066fb786c7f3c3f240fede52c67849a
MD5 e24565c90968ddb9fe13edf0bd7d6e16
SHA1 f6ed8544e56c7a8aa9fd38b82aab784f7dd6d9ad
SHA512 ac4998b99e5f0e93924c595129999e2090db3893a6d1051ebc6dd365760fdf5ff0ab327831cc0d4cfdafcfcbf8d682dd047436d997c63f0bb32406e6706cb2bf
SSDEEP 192:LJONI6Dph6qQmiUyreawGYX59ezrCOszV3ehkIIx/5RoU6:lONI61ZLawGYX5EiOszVl6U6
TLSH
T187122B35A8B8AC7B5DD3A951B88B35038EE8521BEB857F94D5DC2A1C01DF29C130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d6538281309536c73d949d9e712434f15199a64bb57cc63a2a592163ca3aa6ae
MD5 e3abf6d25495b476d4884cf797f50968
SHA1 631f87164aa3347b5282ed7361816689ea777ac3
SHA512 172989ea790d3347246fc4ac45b0a932928bd3a475a3a72ae1d68a50d41d0d6addca1525de621701c63e2f8c63cb632cd5e5dd3dd9f8017e0e30f804d04e534a
SSDEEP 192:u3zosNt/QjRphvFk7QmiU1MAR4BGYX59ezrCOszV3emkH1x/5RoLqy+K9Y:bsNt/e356/eBGYX5EiOszVu6X+gY
TLSH
T1AA423A36A8B8AC775DD26541F84B36138EF8511B97C82F98D5ED6B1D01CF29C130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00e1b0cb-6c38-4a11-a066-6eb3b9a16d9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\00e1b0cb-6c38-4a11-a066-6eb3b9a16d9f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 35072ae2bef09ed5ac71b2e5ccc5c3cccaddfea1b3f84a11ae3deb48fed926d2
MD5 16353ad483b49787fedb0f5a0b3a279d
SHA1 7b20b09a19cc7b0a4a7facc177f37a7df5cd35fb
SHA512 8fd6ef69a7fd03210db1fb23c17833c4f2cbd5885366355c7f4fce966a5f2dec49aedee693a09853c3344e680cce4223704c5e5b649992a208a8a31f4a3067c7
TLSH
T10241585CFAE91018B3B36F5AABF2B9AE447EB8372E06C59D00110D4F0A63A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download