hxxp://Android_A1OMYP9X[.]local

Analysis

user interaction
yes
max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://Android_A1OMYP9X.local
Sample260929-qqnqlshd39

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3892	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{19417534-D231-4C93-AE86-96010D51D569}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 2448	3792	msedge.exe	86
PID 3792 wrote to memory of 4696	3792	msedge.exe	88
PID 3792 wrote to memory of 3892	3792	msedge.exe	89
PID 3792 wrote to memory of 4696	3792	msedge.exe	88
PID 3792 wrote to memory of 4696	3792	msedge.exe	88
PID 3792 wrote to memory of 3308	3792	msedge.exe	90
PID 3792 wrote to memory of 3308	3792	msedge.exe	90
PID 3792 wrote to memory of 412	3792	msedge.exe	91
PID 3792 wrote to memory of 412	3792	msedge.exe	91
PID 3792 wrote to memory of 412	3792	msedge.exe	91
PID 3792 wrote to memory of 4488	3792	msedge.exe	92
PID 3792 wrote to memory of 4488	3792	msedge.exe	92
PID 3792 wrote to memory of 4488	3792	msedge.exe	92
PID 3792 wrote to memory of 3164	3792	msedge.exe	93
PID 3792 wrote to memory of 3164	3792	msedge.exe	93
PID 3792 wrote to memory of 3164	3792	msedge.exe	93
PID 3792 wrote to memory of 4000	3792	msedge.exe	94
PID 3792 wrote to memory of 4000	3792	msedge.exe	94
PID 3792 wrote to memory of 4000	3792	msedge.exe	94
PID 3792 wrote to memory of 1104	3792	msedge.exe	99
PID 3792 wrote to memory of 1104	3792	msedge.exe	99
PID 3792 wrote to memory of 1104	3792	msedge.exe	99
PID 3792 wrote to memory of 4260	3792	msedge.exe	100
PID 3792 wrote to memory of 4260	3792	msedge.exe	100
PID 3792 wrote to memory of 4260	3792	msedge.exe	100
PID 3792 wrote to memory of 4712	3792	msedge.exe	101
PID 3792 wrote to memory of 4228	3792	msedge.exe	102
PID 3792 wrote to memory of 4712	3792	msedge.exe	101
PID 3792 wrote to memory of 4228	3792	msedge.exe	102
PID 3792 wrote to memory of 4788	3792	msedge.exe	104
PID 3792 wrote to memory of 376	3792	msedge.exe	112
PID 3792 wrote to memory of 376	3792	msedge.exe	112
PID 3792 wrote to memory of 376	3792	msedge.exe	112
PID 3792 wrote to memory of 4276	3792	msedge.exe	116
PID 3792 wrote to memory of 1284	3792	msedge.exe	117
PID 3792 wrote to memory of 4956	3792	msedge.exe	118
PID 3792 wrote to memory of 868	3792	msedge.exe	123
PID 3792 wrote to memory of 868	3792	msedge.exe	123
PID 3792 wrote to memory of 868	3792	msedge.exe	123
PID 3792 wrote to memory of 1848	3792	msedge.exe	128
PID 3792 wrote to memory of 1848	3792	msedge.exe	128
PID 3792 wrote to memory of 4320	3792	msedge.exe	131
PID 3792 wrote to memory of 4320	3792	msedge.exe	131
PID 3792 wrote to memory of 4320	3792	msedge.exe	131
PID 3792 wrote to memory of 4276	3792	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Android_A1OMYP9X.local
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff9f6afc188,0x7ff9f6afc194,0x7ff9f6afc1a0
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,1928695416487356374,11592469499675652775,262144 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,9211776723169500197,5614212441261875672,524288 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,18184877877565474180,8848841016507887459,524288 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15528150576461398498,3641163137466066812,2097152 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,144953418878220368,3742451359947067589,2097152 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,5753071075546035727,855466497573747578,2097152 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,8391695226510067594,13110714046137420395,2097152 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3644,i,857930381258881432,1557089872604564049,2097152 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3476,i,9422738078415375505,3650739868418387407,2097152 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,8629183797158383337,8709537711858598424,524288 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,12116353553656109495,13032251057884563508,524288 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,3712099519646988688,14193622028506595376,524288 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,3712099519646988688,14193622028506595376,524288 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6364,i,4681264032206768765,1713597749370958261,2097152 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,14080235429637741998,633264897518575469,524288 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,16416208267549873212,5408824988064716879,524288 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,5336859672194430978,7069970364580618504,524288 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5256,i,9682409382692847659,16562981047150854038,2097152 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,10216959982599713302,15461404038183422833,524288 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3028,i,10237986158014084554,11549687158427544842,2097152 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=1668 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5264,i,4348051300840723881,9759528618440167815,262144 --field-trial-handle=2360,i,10886328039171505845,16467369226825390791,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bbf4f16a525bfee958fdaf9d0fa8afc7cb9b6579a5ded4d3f7d36f5a99162c56
MD5 16fd7f184c981fa2c69a13d13adbd6eb
SHA1 f37495450b72101cfb6d20ba6246c85b06323e96
SHA512 786d35c08c8d67d84c2685bca95d637c391d2e9ddfdaede350f679fe4f84f859e11d430da4c014b68e5663cb1aa63e99f8ec4cd7f8feb65546b688aee5f59681
TLSH
T104615D810BB088B3FBA451F8C6F498D7BA32938D54839D110AE4F56D5C5332741F720B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 d545fb32c4f58e7d90146cfa1e85bd6e29a29951c32bad5a177dfb424ae0f462
MD5 8ce6880c66d699e3a0e7063b8315be6d
SHA1 b8cb45d5930819e6087a2a2058795808b4b5ac6e
SHA512 60f4766f8582169ffce6f8ddf16bd50761dad7e24d6a2127fcab4c7387835d588fbe599825004c14dd33a886d8b85b1e7a8cc7f7c5a0b298f6e71cd2088d4141
TLSH
T16E117DF3C3D585AEC90156F05A24AE1BCE1D0506421C7C59D5D4EF6793E3075D10199B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 aa19868dd3f03d97b2503c05e0fb71585f204ec04c409b262bf0956585f1378a
MD5 e7b2e65cd2737842559ac24936574ce7
SHA1 0eebd9740fbb31804a79b9af084b4dc6a6c095b5
SHA512 26d80f56e3b74e7ef452366f5327e4501bebad53c80c673c540428fdc9c4a668accadda636429f28c66f1c6e67d7bff7c5690c21c4fe63e464bb42b4197e189c
SSDEEP 192:sxZkR0Wv/fcs8+IdpVrHW6+WNGYgUrRIgrJ:sxZkNv/fcs8v1HbGS9
TLSH
T12C22B851AE28A97B8CC7D20DBA15BF13D6F9503261D51E48E6FC961C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fae5717e4a58d2b6f2325f27d2105aec04243ad3bcc38312228fca896eabfffe
MD5 5fbd2512ed5026cbf3ceb17bd453af99
SHA1 9d6dd357d22a564a682b3d2bfdd346b786a4d039
SHA512 8fe649345306694b059d23541596766ae7435d042a1e3caf385803a191fcd55d2b42dbe27172667fb59bfcacaf1170ebbfab90a7f2054e47c4a424fc03719eb4
SSDEEP 192:sxZkR0Wv/fcsc+Idp/rHW6+WNGYghrRIg5RJ:sxZkNv/fcscvzHbGpV
TLSH
T13E22B752BE28A97B8CC7E20DBB15BF53D6F9503251911E48A6FC961C05E7BCD520780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2aa46c2803f38059cbb9c239c84907b5d4fd99d6aea2a062a33374ba1b6ad343
MD5 58d122d48e90b58dd8d9b271e3bb70dc
SHA1 0b5d1ffb23b8b9db2dc7cf9ed047bc68419d1bd8
SHA512 ce6f0ee4e9cfd0e3edba1e5a27f8dffd222664f252edfd5a885c9f7469edf692531a4e9cb7f88847ff10eea6d18c67c0335030e2e4af72b1ae1fe3f6c2b9eec4
SSDEEP 192:sxZkR0Wv/fcsc+IdpVrHW6+WNGYgyrRIg5RJ:sxZkNv/fcscv1HbGkV
TLSH
T1F622B752BE28A97B8CC7E20DBA15BF53D6F9503261911E48A6FC961C05E7BCD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 db6f93485497a32cc70de0e6d3765afe1e88c935ac8c10b8cd79a11dc775f5bb
MD5 2ad912482040161063ed37db3eccccc1
SHA1 a897b3c386d67d1dfcd51dc9c21172bbe23f67c7
SHA512 a6294a73eb538d3391b18fb390b189c1c8ad308c41ceb7692acbc8fd65004eadbbc08bc2c96a40b5048eafecd82b6dd215ed85f80069a9c21b5364cd0a81ba06
SSDEEP 192:sxZkR0Wv/fcse+IdpVrHW6+WNGYgUrRIg5DJ:sxZkNv/fcsev1HbGSj
TLSH
T16F22B752AE28A97B8CC7D20DBA15BF53D6F95032A1D01E48A6FC961C05E6BDD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 30f3c93f608f2ad88d8c630e49a9661932b2f72ea1ab8033b42fe1d2332e963f
MD5 aa8e8d3682186f83740cba071e8937fb
SHA1 51785963c5e32ddcba4f7ec600afd936e923283d
SHA512 ff5af85703bf5ad1c41179fb2b0b448377d15adbf4007911ccc32fe8fdf6b2e32c8c4a40143b37614cb0fa3756aff343c9bcb043ca903fe3222052082ff22b6d
SSDEEP 768:fkichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzkroOmf:fkichfPWvPZplu1jan+LKgzv1f
TLSH
T177C2E97B640CCB7E4FC01E9DDD1A6F9A7E9802C7AA588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cd17b41abf6883d9935a93db93329ad73cff1e1b06903a4435cac4af164759d3
MD5 282533c053471b7d621cac62c9ca8e40
SHA1 9e519b40b5d9e79c6597718a0ae906b2df511de5
SHA512 0d859fd0398bb7415cefac18f2d6e01316fe9121530d66ae862ca9e4289d86b54773cd8a94f6264143c1ec89952b7ac3da409291c76f4c8d63a33dd58bf8597d
SSDEEP 96:KAdOKOY6VAr8QuC+giapzIIgKQ1IWgsYIZ2LU4KhWaD:URVAr8QuC+1ap8IU1IWdYIZ28TD
TLSH
T10F91174535BF16443DFDB8498275862E454232AA339CFA3B7FAC40A34E5AD081DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7d63c7d-57e1-4e50-8550-738562efcf97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b7d63c7d-57e1-4e50-8550-738562efcf97.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 db86e94cd8d5db5cdb17a494a4bbaf90d9339e09e7c493cf24b98fbab7034ebb
MD5 10fd33b59c2e0a4f29a7dfdcedfa0c6c
SHA1 fff3c5ecd2e1aa8ae8d47dc3cf66febeca76ab87
SHA512 30c9b2f9fea41782cb6a0e9d44664e058fd6eaa53a76fc19d3e81fb4c5e42a938fccb0e7e5423c2aeae6369b74c7363b58b8727f40b6f89f338253323ab7d37c
SSDEEP 384:PZcIhsN1TL15UbZuBGYX5EzyOi6QUXpX4tgOIwZOyw6oE:HhoMeGYuzyO3QUXx4Xs2z
TLSH
T15A826C32AD789DBB2CE7A141F54B36035FB88067E6C4AF94D5ED7B1C019A698130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 a61352eddcea2b751e81fc6c5346faee4b1ddd52f4ae5c1fe6abbd61ed9c78cd
MD5 14a6e689c821559fe28f45695a390c00
SHA1 53008e5375e90f918079eb7586c211ef38957ced
SHA512 00e5dae9702b4d9f5f85b8f2fb6d915f47c92dfaed50eb7e97a509847a71c5d6b419a19631993f963d0f1949a0f0ef19a2a66e8253b8d8fc714c8829a8fe4170
SSDEEP 384:WQiFiZcIQzsNP8TUNTUlIl2L15UbZuBGYX5EzyOi6QIDpX4tgOIwZOyw6oE:WrFQMOwgqMeGYuzyO3QIDx4Xs2z
TLSH
T11FA26B339DB8CDBF6CFB5A81F54A32039EB44067D9D5EB90E2DD6A1C019A1D8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 35d958e549c3def3cca59ea5c3485f7c1e0a21e55c3f9474d89cc4965dd9062d
MD5 c0171884e61a1ad47749504e4603144a
SHA1 8f487269a30d0a5dc20a16af18dc9ed300f9ce34
SHA512 ecaa8c1ec60919bafaff0ac352f05f571ad721a4e73264a421703f3d13719886a0aa854298e24dd3c4b55777dafcbf6448eb31e1765ba6a4b4c299550dfd76d5
SSDEEP 384:EZcIhsN12L15UbZuBGYX5EzyOi6QUXpX4tgOIwZOyw6oE:ih7MeGYuzyO3QUXx4Xs2z
TLSH
T190827C32AD789DBB2CE7A141F54B36039FB88067E6C4AF50D1ED7B1C01DA698130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3e1743f9e24ba5d523439f2251ca057ca1dd3c647107ee3f422e6e6ead0c004b
MD5 7e55e1155e2d4ed429f105e1a39afede
SHA1 741521fa4949b609129b723da69aeb79bf994fb4
SHA512 534fc475fdee68e887c07cf4d701fa77f2a8ef293be97f2ca30f3af4069c84eb369ea8cfe364304674d381f1285b29395bcd6e984d119df2cb4ed4b1ee927db8
SSDEEP 192:LJONf6DphmqQmiUyVkq8wGYX59ez6CyORMWkk7uyU6:lONf619BRwGYX5EzyOiwxU6
TLSH
T14502E834AD78ACBB9DE26E45F48737136FE4112BAA946F44D6D82A1C019768C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e7de26265ddd896726340634068d8ac04a336a1b5ffc2e50203634a17a5d6046
MD5 3da7e51bb269dd1c2bf265c272fbbb17
SHA1 2d7e4d94306b66be3ccc353c057b36b122fce18d
SHA512 9d6f13daf56e351931a908b4401221b3af04f9d9ad0547a459a7cdbb6f64acd9c1c3cb08e9dded9711412819311ffbe125e9f32043f3bb3ac664a7eebbd4ab9e
SSDEEP 192:LJONo6Dph4qQmiUyRkEwGYX59ez6CyORM6QjkIIpoq5n4U6:lONo613nEwGYX5EzyOi6QkpX4U6
TLSH
T113120832A978EC7B1DE26551F48736139FA45127EA887F54D2DC3A2C01DF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b658fbee-db4c-46d4-9cd3-1ba6f3910743.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b658fbee-db4c-46d4-9cd3-1ba6f3910743.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d9ffd4a078f6696ea527107f1411a2b5b4f3341a3977cd6c831962645ad928e9
MD5 532c8a20dc26562647e29f5aac8401da
SHA1 4bd53ae9ff9924b246f5fac79286aa1c1631edd2
SHA512 263e9ca3fe1faaaefec77370d69027eea1cb186ee1c9a107e62cde6d575dd2604a24dde31b65e276dc2144adcd5ec1845461d1ee778a2f2be0d02df4dcd1fabe
TLSH
T12B410748A7F91148B3B76E57ABF6686D587A78372A06D19E10110E4F0A72B40C8A1733
MD5 SHA1 SHA512 TLSH

Submit Download