hxxps://roq1m1[.]co/v97&9[.]pk/#hxxps://outlook[.]office365[.]com/owa/?ItemID=AAkALgAAAAAAHYQDEapmEc2byACqAC%2FEWg0AgNOjy2x82kyGhRDWSNjTtwAHsinKzgAA&exvsurl=1&viewmodel=ReadMessageItem&nativeOutlookCommand=openMessage

Analysis

user interaction
yes
max time kernel
71s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://roq1m1.co/v97&9.pk/#https://outlook.office365.com/owa/?ItemID=AAkALgAAAAAAHYQDEapmEc2byACqAC%2FEWg0AgNOjy2x82kyGhRDWSNjTtwAHsinKzgAA&exvsurl=1&viewmodel=ReadMessageItem&nativeOutlookCommand=openMessage
Sample260924-gp3npsfd68

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5436	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347032006981823"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{1F0C41B0-0985-447C-8EC0-0A7A764638DA}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 1560	3444	msedge.exe	85
PID 3444 wrote to memory of 5436	3444	msedge.exe	86
PID 3444 wrote to memory of 5760	3444	msedge.exe	87
PID 3444 wrote to memory of 5760	3444	msedge.exe	87
PID 3444 wrote to memory of 5760	3444	msedge.exe	87
PID 3444 wrote to memory of 2908	3444	msedge.exe	88
PID 3444 wrote to memory of 2908	3444	msedge.exe	88
PID 3444 wrote to memory of 1168	3444	msedge.exe	90
PID 3444 wrote to memory of 1168	3444	msedge.exe	90
PID 3444 wrote to memory of 1168	3444	msedge.exe	90
PID 3444 wrote to memory of 5912	3444	msedge.exe	89
PID 3444 wrote to memory of 5912	3444	msedge.exe	89
PID 3444 wrote to memory of 5912	3444	msedge.exe	89
PID 3444 wrote to memory of 4028	3444	msedge.exe	96
PID 3444 wrote to memory of 4028	3444	msedge.exe	96
PID 3444 wrote to memory of 4028	3444	msedge.exe	96
PID 3444 wrote to memory of 2484	3444	msedge.exe	97
PID 3444 wrote to memory of 2484	3444	msedge.exe	97
PID 3444 wrote to memory of 2484	3444	msedge.exe	97
PID 3444 wrote to memory of 1448	3444	msedge.exe	98
PID 3444 wrote to memory of 1448	3444	msedge.exe	98
PID 3444 wrote to memory of 1448	3444	msedge.exe	98
PID 3444 wrote to memory of 3408	3444	msedge.exe	101
PID 3444 wrote to memory of 3408	3444	msedge.exe	101
PID 3444 wrote to memory of 5140	3444	msedge.exe	106
PID 3444 wrote to memory of 5140	3444	msedge.exe	106
PID 3444 wrote to memory of 5212	3444	msedge.exe	107
PID 3444 wrote to memory of 5212	3444	msedge.exe	107
PID 3444 wrote to memory of 1912	3444	msedge.exe	109
PID 3444 wrote to memory of 760	3444	msedge.exe	117
PID 3444 wrote to memory of 4600	3444	msedge.exe	118
PID 3444 wrote to memory of 4672	3444	msedge.exe	119
PID 3444 wrote to memory of 4004	3444	msedge.exe	126
PID 3444 wrote to memory of 4004	3444	msedge.exe	126
PID 3444 wrote to memory of 1780	3444	msedge.exe	133
PID 3444 wrote to memory of 1780	3444	msedge.exe	133
PID 3444 wrote to memory of 6028	3444	msedge.exe	134
PID 3444 wrote to memory of 6028	3444	msedge.exe	134
PID 3444 wrote to memory of 6028	3444	msedge.exe	134
PID 3444 wrote to memory of 5652	3444	msedge.exe	135
PID 3444 wrote to memory of 5652	3444	msedge.exe	135
PID 3444 wrote to memory of 5652	3444	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://roq1m1.co/v97&9.pk/#https://outlook.office365.com/owa/?ItemID=AAkALgAAAAAAHYQDEapmEc2byACqAC%2FEWg0AgNOjy2x82kyGhRDWSNjTtwAHsinKzgAA&exvsurl=1&viewmodel=ReadMessageItem&nativeOutlookCommand=openMessage
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2e8,0x7ffc7692c188,0x7ffc7692c194,0x7ffc7692c1a0
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,15692454084091549490,9114583308040453516,524288 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,7560261328375263037,10371139848332942099,262144 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:2
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,11838177381228097784,1872575532443194229,524288 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,18381276239167892195,1759104536102794202,2097152 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,8499074482429735311,8426591012755026275,2097152 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5248,i,14043564766133849235,130117963285017740,2097152 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3532,i,7612508935798288544,11017418912536782173,2097152 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3652,i,17135016771853083634,649833804032681762,2097152 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,2451049444432585845,3164783078582721191,524288 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,3535024654826928586,3333394717208147629,524288 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,846479050152392240,7756126702628487727,524288 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,5750456071019487707,2180643260845318088,524288 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,5750456071019487707,2180643260845318088,524288 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,15061047027707159863,17224845659012572155,524288 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,7256497158376456571,2980065236386037216,524288 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,2816450405619177690,1282783302364328479,524288 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4008,i,12470460363870756120,17777920432312579843,524288 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,12241166530588154939,12299708389662623388,524288 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6812,i,5218447115804419206,6274492509126542814,2097152 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6108,i,12926596805697735658,16448687231763968573,2097152 --field-trial-handle=2816,i,14914749839747793530,3941774714260931591,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:5652

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bc826aaa75d7da810bfdc30a1671df54c18887a7ddc779d5b9f03835587852b4
MD5 77e198de5db1473b46a54bf11e90ef65
SHA1 d40423f0ddb590b81cb9016394df150361acaffc
SHA512 208c9def9ae2c86b2de012eeb71379c0f243edb53a958e991a05233405a4a20955e43cd9ddeb6944b19a1811ed512d3123f7d75ab4ca5b9a71dca6edca139ba2
TLSH
T1ADD08028B57C7BE4F03D353D0224414C31CD5AB156067545925417554FD155315D48E9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 1eb525579da6d3371505e6e5dbea5251501430297a3352077f9dd3c196ab9376
MD5 3cc6b1266dbef4f6129c350f1ffb32de
SHA1 d8e47089106f1f8c4cd08effd4c6412ad07952ae
SHA512 1317a70e74b37df67d656618905fa67bbd7c5eb0a95c2ddf4a2477afa7e90301615f2297457eb56f09c8bafbf17ed404363645610e11ab8d182a17b4d8cdeb7f
TLSH
T19CF02D75C821EC3B18FD1B7D20950746F750232B26519C8F3B3D410C4FB0537858582C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1eb9fe04c9c39ffa5810a409821b3d1f52835ac90792b76d0e5e910cf8298ee8
MD5 04af6e686104c4286d31aed06fcf4450
SHA1 e71a20de574fb44c7f0abd18f5d98d3ad21b105f
SHA512 3117c6790f647a5eaa0eebb3339de6d4a4301c50a3fbd2181702d5dc7b35c4eebd3f6ff04e2458da6b488595abca568f094bad56779751759a80b9155bb93ce5
TLSH
T1C281CDF7C3E8866DD91155F4AA186E2BCE980519436C3D5A89E4EF0B93F2471E240A4B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ab1a7e4e9d1f18395215f894934cbfe28c3858d7eff9cb2586aeaec31b7b47db
MD5 b7d57e2c8fcefc005445e30918957c1f
SHA1 e39ee6750672f500442be802727e12e82fa26d43
SHA512 d506e54f38055199b446ca74907fa490726ea2a331efef53de785730da773a6edccad0af3beedcae1710f26a0dffc0fef4eefb586d1685b16c393b6588fcef04
SSDEEP 192:sxZ5R+k5/f+szQZLp8zzodpuJAlflh5vHW6+WNL//JivIA/Yo22SOMIg50tSJ:sxZ5b5/f+szO6oN5HbCj/xSXetu
TLSH
T15952D7166938697B8CD7D219BA49BF53E2FD507390C05E88ABFC8A2C04D77DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0de343f23262a4137a839f0ad8f4f65a6c49a1ff95ba1e479d4b10fe321e7a18
MD5 fac3aba4347f0aa1ac878c53e5649f03
SHA1 234630fd06cf2f3a3ffd270dfab8d07438063ed4
SHA512 72d3920504adfc49a298a0507cf383e5bc71034b6f0756c1c13ad42c9c97d4d8306ab142f70f0a747e1fce71e58fe154b8a9015c5ee8b00ff78de94e181cd40b
SSDEEP 192:sxZ5R+k5/f+sK+QZLC8zzodpuJAlglh5vHW6+WNL//JivIA/YoE2SO4IgjtSJ:sxZ5b5/f+shO1ou5HbCj/jSljtu
TLSH
T11052C7566D38697B8CC6D219BA59BF53E3FD507290C04E88BAFC8A2C04DB7DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 258ea458537d69244fec4c92f9251c19274e1e949aecfc64f4d23542a958e59d
MD5 385920f570a323a94a95ea0d869c6b56
SHA1 8038a0319f7c7c9bebba4d47cac63726b0a926ca
SHA512 44a249d8c5fc4cc7b4a6d1d93a2784077ba645b4c59c7e2d70759788b456b91e404c00dc858e5bef1222a379ff59799d645ada0781467f5b2966598e33308454
SSDEEP 192:sxZ5R+k5/f+sZ+QZLp8zzodpuJAlflh5vHW6+WNL//JivIA/YoE2SOMIg50tSJ:sxZ5b5/f+sgO6oN5HbCj/jSXetu
TLSH
T14552C6166938697B8CC6D219BA49BF53E2FD507290805E88AAFC8A2C04D77DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 1ded177db8190967b4530d2813844b4a77ae5a7f4672d10a44aac4a84451070c
MD5 06126dd016231a749beddf3a2af79a70
SHA1 9a31b5100b07868a1c050eb5963166237c1f8a1e
SHA512 b71b2f550179d397c51f43eeeb86a4e2a5e3b664c167c6313df03096135a0b98344a160681f261642bc95ef1bdd63fdcf8a259ecfde3ed6fdfc8741441fde172
SSDEEP 768:Px6r8j+Wviy8K8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYrooWYbgno2:Px6r8j+Wviy8Ku1jaqpLd4jjoWgg/
TLSH
T1ADC2E93B740CCB7E5FC41A9DDC5A6F972DA802C796588D408BFA944C02C77EA912B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 fa601fcbe8d588c62f122f4df7b4d1639cfbc204d3ad82ca59c90e012f33100f
MD5 10bc16c4333b1cc8cf442a3a933566a6
SHA1 2678f8325b4484d89004b9bf21ccec8010eb9195
SHA512 2fde9d5c93c183fbf63cafc6817f4966d0994dd5cc0f85c6d8ba913d8f45fe2951bbc8ab8b39213d466ef1418c6b4117b1382c47b32760c5e2d4accbf6b47dc5
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgr:ST/2dXOJhJlpfnpp3tNXVrN3GlnMb
TLSH
T1FEB2231571BB421039FE391892B6972E064271B33119E66B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 582c242cd20f441ee1b4e497d4b06c3c512a4b531d6f9588c9e6e7920d41d71a
MD5 7c5b6f33d3a4dbc764798cfd97e67822
SHA1 c9072c5d11511d0a582b96dc29175ef5c86690ac
SHA512 44e74cdfed5e8dfb9817554d462b63314f41980a19e93a891f40da5a53b508ba1355b8380e3414dd831417805b33651339554e5536eff5a508e95f5d746c9e1b
SSDEEP 384:nliFiZcI2sN+8TUNTUlI4gaKMJ/UawzWf/BC2uZneCUOcuwxiPmKCgL/7Iz9oJ:sFQ2bwg4MR4BCnnr/cbxiPmKua
TLSH
T142C23B72ECA8D9ABFCEA4BD5A70A3A03DEE05153998C9AC4D9DD5D1D009B1DD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 72155c1e35f570cb8c642a460a78ab45774d094dcefa820b5333a9d21913e2a4
MD5 ee050204339d011799504047b8396540
SHA1 fcc9520b232384ca2b8b6102f9c721293ea8322d
SHA512 38e48580bf6f158afa1d86f521672c84d152945cf8aee6548ccf7def9e28c39e4f6a93600ebe9ed4ddfbe1d3581a00d52912cf538fc951836ead7d4d27055af8
SSDEEP 768:BFQLbwgp4R4BCnnr/cboiPm0Sa7dLKkGuZ:QLL6rjgm0TZ
TLSH
T13FC24B72ECA8DABBECEB4BD9A70A3A03DEE04153998C9AC4D5DD5D1D00D719D430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 776d10aa18cd843f61b9837f1c542047174c1a0b09952d5f4513a47e1f714744
MD5 de32001224679fd3938b41eac7a67544
SHA1 d36a02c890cbeb471b7d17a3182b17f8058691d6
SHA512 0f8f4446e255d4c57372d217a3c83f5c15183021303538a4f368aac494d1d33800319d07d8a24d0b4b927652a3dbcea92daf3881a50e27b3cf2e1d1875878f9a
SSDEEP 384:nWiFiZcI63sNu8TUNTUlIm2aKMi54wzWf/BC2uZneCUOCFN+7O6R2Feo3IgL/7Im:9FQ633wgcUH4BCnnr/CFo7TRyx1
TLSH
T167C25C36EC68DAABE9FA8FD9A70A7A03DEE01153958C8AC0D9D85D1D00975DD0707C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7627e0b309fb3afbea54b3272b310ca8bf06efa7230aa00b72b80ce7ecc4f0f0
MD5 17a1df19a48590d3799511d2f395c723
SHA1 60b743246ba774605426065b5711d28fc38c0254
SHA512 d4ebfba122af953ec8dcf99f01a8f13f0d00fbaedf45e7e589fb5584d6a0a79d7936de57345565e3f4ad74a5588205051c75d7993af73f38a28882b2402dd805
SSDEEP 768:VFQ/bwgbKv4BCnnr/cbzmPm0Sa7dLKkGuZ:k/9urQ0m0TZ
TLSH
T132C25B72ECA8CABBECEB4BD9A70A3A03DEE04153988C9AC4D5DD5D1D00D719D530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f51572d7fa5e5bbeb777d0b21aa10986240fb6c0848ad0541c175e1b63e4b820
MD5 b7179eed407179c71c86d5d157917d5a
SHA1 529d015f5d9551d41fcd9c1ee4198127ec44b828
SHA512 5a8a26a4ef521bb61c8e86edbe816054df4d0ddc7397ff5a7e60a33fd393921249bf1f70d3ee2d86cedd820832320902fd44aef3772c9ff1b74fbfbfc3cc969c
TLSH
T13D412B5CA7ED1108B3B77F5AABF6A8AD887AB8672F06D45E10110D4F0777A40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1912-211-0x00000196EAEE0000-0x00000196EBEE0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads