hxxps://www[.]tracktion[.]com/products/waveform-free

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.tracktion.com/products/waveform-free
Sample260925-tx5jgsff46

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2220	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{0FA15B72-5266-40D5-97A4-B68CCF6FE6AF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5332	msedge.exe
5332	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 4788	2360	msedge.exe	88
PID 2360 wrote to memory of 684	2360	msedge.exe	89
PID 2360 wrote to memory of 2220	2360	msedge.exe	90
PID 2360 wrote to memory of 684	2360	msedge.exe	89
PID 2360 wrote to memory of 684	2360	msedge.exe	89
PID 2360 wrote to memory of 64	2360	msedge.exe	91
PID 2360 wrote to memory of 64	2360	msedge.exe	91
PID 2360 wrote to memory of 3756	2360	msedge.exe	92
PID 2360 wrote to memory of 2068	2360	msedge.exe	93
PID 2360 wrote to memory of 3756	2360	msedge.exe	92
PID 2360 wrote to memory of 3756	2360	msedge.exe	92
PID 2360 wrote to memory of 2068	2360	msedge.exe	93
PID 2360 wrote to memory of 2068	2360	msedge.exe	93
PID 2360 wrote to memory of 4396	2360	msedge.exe	94
PID 2360 wrote to memory of 2572	2360	msedge.exe	95
PID 2360 wrote to memory of 4396	2360	msedge.exe	94
PID 2360 wrote to memory of 4396	2360	msedge.exe	94
PID 2360 wrote to memory of 2572	2360	msedge.exe	95
PID 2360 wrote to memory of 2572	2360	msedge.exe	95
PID 2360 wrote to memory of 4300	2360	msedge.exe	99
PID 2360 wrote to memory of 4300	2360	msedge.exe	99
PID 2360 wrote to memory of 3344	2360	msedge.exe	100
PID 2360 wrote to memory of 3344	2360	msedge.exe	100
PID 2360 wrote to memory of 3964	2360	msedge.exe	101
PID 2360 wrote to memory of 3964	2360	msedge.exe	101
PID 2360 wrote to memory of 3964	2360	msedge.exe	101
PID 2360 wrote to memory of 2372	2360	msedge.exe	105
PID 2360 wrote to memory of 4736	2360	msedge.exe	106
PID 2360 wrote to memory of 4736	2360	msedge.exe	106
PID 2360 wrote to memory of 5812	2360	msedge.exe	121
PID 2360 wrote to memory of 5812	2360	msedge.exe	121
PID 2360 wrote to memory of 5812	2360	msedge.exe	121
PID 2360 wrote to memory of 5868	2360	msedge.exe	122
PID 2360 wrote to memory of 5868	2360	msedge.exe	122
PID 2360 wrote to memory of 5868	2360	msedge.exe	122
PID 2360 wrote to memory of 4220	2360	msedge.exe	124
PID 2360 wrote to memory of 3336	2360	msedge.exe	125
PID 2360 wrote to memory of 1004	2360	msedge.exe	126
PID 2360 wrote to memory of 5800	2360	msedge.exe	129
PID 2360 wrote to memory of 5800	2360	msedge.exe	129
PID 2360 wrote to memory of 5332	2360	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.tracktion.com/products/waveform-free
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffafe07c188,0x7ffafe07c194,0x7ffafe07c1a0
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,10010262963354084266,3257423800046289929,262144 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,16361801457401537721,8216149940665975143,524288 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,16841988200337283595,17092678405684352400,524288 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,2526045978065266205,1617883961766613893,2097152 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,801865639900305556,17353915205628474404,2097152 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,9817927177751914693,8003947549145134852,2097152 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,14049295691001614608,4658264242143712891,2097152 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,15598443849446348219,11696312020401727339,524288 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,2725811539724811543,10878010337599262279,524288 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5716,i,5154817086592044555,13729286544103621149,2097152 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,3023975206322519798,12640847156399129036,524288 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,3023975206322519798,12640847156399129036,524288 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,14045976656973907756,2193139133253073554,524288 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5544,i,16120273946066608249,15795328917939329667,2097152 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4144,i,14609451054524655131,17272143297710658366,2097152 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,6290132506546181127,2984202342983417167,524288 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,1898613153074015675,414426345062753480,524288 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,9896942995927215633,14483667341224734896,524288 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,3234614408653821991,2368743515071988062,524288 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6284,i,4100190408627583474,913689855330555284,262144 --field-trial-handle=2224,i,15038041222256722887,1985299268563897573,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fa5c698698bc4a466d31ccde4a0cb70c6dd3d4c890edbab874d801fc576922af
MD5 3fcc8afa6da3246811158754fbd8f2b3
SHA1 2a149ba03ba2a94c3381b88c7b8688a33877b6ae
SHA512 53caa9b8e4b6878c47109d1b2faed4b67fe2be9ce1455cf086bce4222f447954869cffbb642f46a60c67d6201913a74395247ec6e5ff8b1d9f8494bd59be3aaa
TLSH
T17E71515A45BE9132F7C43331D4E205CB32305ABC5B472E0222E6EAF4FBC6349EB5245A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5950f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5950f5.TMP
Size 2KB
SHA256 1d51336949a2e07d8b0234f1ec116cde748ce8f1c9fa52590bd6bb9c1086e364
MD5 33c2169c2ab7d5fbcda498416cadd1be
SHA1 ddb4021d0b7b47051c18ea8f4406270df0bd4cc6
SHA512 189e985490f99c9437a46a62cab7e3d833512466b448b7f4898cc0c4cfdfcf1934ff1c06a6e4145fe3a912e609a94f8ca55be151058925f639e8e29c499488f6
TLSH
T16651634C46F64177F7D84132D5F642C736308B7161832E4222A7F7B8FA86359CB86092
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 20d0b239c33f3ba330a53babdb479c2b1211bbd8ba0c9bcb9c2b260861b141ad
MD5 9f9195a4befdc9a08a01ea059d7a4855
SHA1 86276de11386bf43f04842515f26be7f7014dbf6
SHA512 e2b1bbc93819d8e98b5aca6887494aff3e729532ffea2f882c384ce8e07e764d67674da831732e6a215fa673e1c6f1c1c5684b8470917c8ba3c4ed5cd19c5102
SSDEEP 192:DXUkCisfqeinle16U1HIH7proGIegCPG/fJWVrpmrnYtQ8T:DXUkCisfqeinle16U1HIH7proGIegCPf
TLSH
T142F1AEF7C3E9991E981129F05614AD26CE5C0618821D3D6ACDD5FF8B9BD38B2F20264F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b938bbbef6d93737fb0864f23ff1a719e02440266706b91a5d16a1ced63c1064
MD5 05bb5dd9cc05f14d42aadcf4d9d7a711
SHA1 10bf05153bc855a479c86274672e181e7207a131
SHA512 4c74da2523f888fc55d2f52bcac4d4442180f35fe1cb9633dff57cffc4b50bc70ec8876dd79888f503ba8a73c994b3f783ac946d578242e718e5c20b3aa2e1bd
SSDEEP 192:sxZhR6Wi/fnsqE1IdpVVHW6+WNzKp/YYB2afIgrJ:sxZh3i/fnstGPHbc/ff9
TLSH
T15422B7566E38A53B8CCBD209BB25BF53E6FD503291D11E48EAFC961C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0d6a893d795c7d24ede892a9bd06eecfdf59e590c858da46a19b55a164b97960
MD5 d2a488d5272cb31258def63e1f1b94c9
SHA1 bba268b4f3a04ef84cd43870dce4c0a2c98e8ac2
SHA512 ae2a7c28d5f97c89d4036b3f9a870a9456581baad230ac768c1734383e9f6a234f3b900a4b853cc09a3f440979e8edcd332712df0d175c475957634007e7adef
SSDEEP 192:sxZhR6Wi/fnsiEzIdpzcHW6+WNzScXYYBe/afIg5CJ:sxZh3i/fnslswHbHXfeMY
TLSH
T1E022B7566D38A97B8CCBD209BB25BF53E6FD503291911E48EAFC971C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bcc575b74ab3a55490986ed1faeca5517fdb7ed6655c9a70d58c08fc3c13a963
MD5 482aa1895ac44c2e025fdaa7426e8c8e
SHA1 7ebb06d77448169e91365cff806b383942fe9798
SHA512 7866acc0bbc54542ac4d04100c2a5d91972719a6fb260e7bf0781ae87f4804bef0aa2aaf6c30f0326c1c85afbf43fb2743305b06a68b36456f3bfd4324268f6e
SSDEEP 192:sxZhR6Wi/fnsiEzIdpVcHW6+WNzScXYYBvafIg5CJ:sxZh3i/fnslsGHbHXfcY
TLSH
T14222B8556D38A57B8CCBD209BB25BF53E6FD503291911E48EAFC971C05E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 52161b66fe7668ef7bcfd81158cd70573effb51f47848c55d961d81f5de93759
MD5 2a1dd56161449d66ff25a869bf2b03b7
SHA1 6e61c9d5e1c5f33ee593ca703b701df3036ee7e9
SHA512 167508f546887c44649674bb8f8174a21d17d71903ad640135e2274563f1772f8fbdab29da33fd395350ff697b70413ff63818288febcc799d41dc6a1980c147
SSDEEP 192:sxZhR6Wi/fnshE1IdpVVHW6+WNzScXYYBOafIg5QJ:sxZh3i/fnsuGPHbHXfnK
TLSH
T1CB22B7566E38A57B8CCBD209BB25BF53E6FD503291D11E48AAFC961C05E66CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 de5617a863b6441d9a4c28f6606913b6e426b0deb756ca87a6b9615c8a8a51d9
MD5 0438f1b09910d0477ac3682073e2bba1
SHA1 755dfc9fe1761eeb938f5ff81e6165b14c19a920
SHA512 c568dbbf59f65316299cbc449eea6869dbebbc31cebcc60cda6920edab773a5574781b06b72edb5f7e51028aaf8e66177639d4cca2b1d809e10c65b69597c739
SSDEEP 768:CTyYR7jWv3NRB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXVropPi2:CTyYR7jWv3NRBu1ja/CL8OXur
TLSH
T172C2E93B640DCB7E4FC01A9DDC5AAF9B3E9802C796548D4047FA994C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59964b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59964b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2c7a98aa115c53b301616672a3b77d61d44105b9926a18c12f6781d011b00df5
MD5 f80bc28a8de64992d5fa43666baf7780
SHA1 1c82b2986724a2e7d7ff1ef3cf74eea7e8b27e56
SHA512 c7b1df91ea5f2068042a0e82db6c5a874304e248e891ca35d5a6a0530f743706365374aa353e450cf7e6aa88b3cf86cd708b9a062c15cfa45a9bb802dc0238fa
SSDEEP 384:vZcIhsN6SIAihJWQX5+DtI81KwXiJr8mTgtgOIwZOypfop:nhHAWdkDVDih8mTgXsA2
TLSH
T187829E3299789C7759EBA185B18B32139FB85063D7C46BC0D9FC6B2D01DA7A8030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d36a67283c0b59d1d9472cea29d2d82ccde7d440dca863bb5f6a84db34552521
MD5 c397a961550abcca14df1e1469e6eaf0
SHA1 8a7cf08457cc06261681d872192bf6c4e65bda3e
SHA512 c4d0959342d9066a8dd7d7cfd946523ad98b25badd95435568785c1f29929b23f1e34317af27fb5ce75cd6483b27c130fcad1bdd50363070983ed47372f429fc
SSDEEP 384:kiFiZcIAzsNC8TUNTUlIlPIAihAWQX5+DtI81KwXiJr8ITgtgOIwZOypfop:/FQc3wgWAjdkDVDih8ITgXsA2
TLSH
T1F7C229F248D7883AD9AE5743B37E2D139EBCD063B584A680B7985A1CCD961BFC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7408e321ba9cb469dab6c750fe5894ab7422fd63c5a602e448d38cde2d60e385
MD5 25b54b0d8740ad78da1145fdaa3654ec
SHA1 722e123cbc25bbeab47bd4bcaf96b1db23c21dc2
SHA512 018e2ca4e4350593a9040179752c07b0c93c2eaf28f4c2758dfb2e0aee96f79c210c53bb0221802e3c5ae2d1a4c089234994745ffb254d5791cb5cc9b840b3f1
SSDEEP 192:EONO6nnHGQmiUyAsQYcX5hQDP1Ajzor181mI7McQPcU6:EONO6nC4QNX5+DtI81KHPU6
TLSH
T1F402DB34AC687C7B9AF7AD45B14727139FA52167A5942BC0DAE81B1C01D765C2306D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2cd671df162fef7950dcf5c615cea1ee4757334e5dbc3d4a76f0dfdf8efeac57
MD5 e787b3c78955636bd445ab2babd41d32
SHA1 4de332ad6e6398ba104b62ab726268332800f4c7
SHA512 dec45a63a6c308f9b3114bfafe2466da3d3826672aeaed91ac868e2d50edd2f57c93b22b7fbbed7b67ab7a550ae1d85daca3b7faedd6d7174d2eef55bd01bd7c
SSDEEP 384:jZcIhsN6PIAihJWQX5+DtI81KwXiJr8mTgtgOIwZOypfop:7huAWdkDVDih8mTgXsA2
TLSH
T1E1829E3298749C7759EBA185B18732139FB85027D7C86BC0D9FC6B2D01DA7A8130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 24816021f56b96d4d44a1ac07abb6544406471098adb4699bebbc191f447fa56
MD5 c62d22502973f8dfc18abd6a9a657ec7
SHA1 afd6d7658b621307feef9967b7b590ad20f1c376
SHA512 33af021b56ff9ed2ea54440ee89e4dc1971e14ea6f7419fcade69d1b8ac5ae0145e33b749f4e2127d139d0b3bb708df6845732be46e948b339e5812e978278e2
SSDEEP 192:EONT6nnHsQmiUyDsCYcX5hQDP1Ajzor181mIwXXSJr8eg3Qc/5gU6:EONT6nclCNX5+DtI81KwXiJr8pTgU6
TLSH
T14A120B35A4A8AC775EE3A5D5B0873513AEA51127DA897BC0DAEC2F2C01DE75C5309C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eceb5b82-0fd7-49e5-960b-0792b90222c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eceb5b82-0fd7-49e5-960b-0792b90222c4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 af00e7b87a611705d1b11977dd2d10d1c366074c7812aeaa066f1ebe92740295
MD5 b38d6f39ce1a8bb5a0a7df5ccb5e32fe
SHA1 9b35c59fe4b22abf19a77c7d9c96ad0e16bedb9c
SHA512 a3ac6f489097146e8157561333ad515161c07bbd0f30da7bfb11ef6fa6a166ccfaa3b3a797caeb1593e2f2564dd673737eb57615b4a2ec94439b1c6a39fc9d23
TLSH
T12B412759AAE9115CB3736E5AAFF6A96D847FB8732E06D45E10010E4F0A27F40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download