hxxp://www[.]bpoutsourcing[.]es

Resubmissions

29/09/2026, 17:56

260929-wjbqcsty9n3

29/09/2026, 17:31

260929-v3qsyszcrd3

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-es
resource tags

arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
29/09/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.bpoutsourcing.es
Sample260929-v3qsyszcrd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3764	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{0ECB4697-0B98-45E4-8315-C45F8401D510}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 1320	4724	msedge.exe	87
PID 4724 wrote to memory of 3764	4724	msedge.exe	88
PID 4724 wrote to memory of 1544	4724	msedge.exe	89
PID 4724 wrote to memory of 1544	4724	msedge.exe	89
PID 4724 wrote to memory of 1544	4724	msedge.exe	89
PID 4724 wrote to memory of 4224	4724	msedge.exe	90
PID 4724 wrote to memory of 4224	4724	msedge.exe	90
PID 4724 wrote to memory of 4312	4724	msedge.exe	91
PID 4724 wrote to memory of 4312	4724	msedge.exe	91
PID 4724 wrote to memory of 2044	4724	msedge.exe	92
PID 4724 wrote to memory of 4312	4724	msedge.exe	91
PID 4724 wrote to memory of 2044	4724	msedge.exe	92
PID 4724 wrote to memory of 2044	4724	msedge.exe	92
PID 4724 wrote to memory of 1848	4724	msedge.exe	94
PID 4724 wrote to memory of 4696	4724	msedge.exe	95
PID 4724 wrote to memory of 1848	4724	msedge.exe	94
PID 4724 wrote to memory of 1848	4724	msedge.exe	94
PID 4724 wrote to memory of 4696	4724	msedge.exe	95
PID 4724 wrote to memory of 4696	4724	msedge.exe	95
PID 4724 wrote to memory of 3268	4724	msedge.exe	98
PID 4724 wrote to memory of 3268	4724	msedge.exe	98
PID 4724 wrote to memory of 3268	4724	msedge.exe	98
PID 4724 wrote to memory of 2096	4724	msedge.exe	100
PID 4724 wrote to memory of 2096	4724	msedge.exe	100
PID 4724 wrote to memory of 2096	4724	msedge.exe	100
PID 4724 wrote to memory of 3968	4724	msedge.exe	101
PID 4724 wrote to memory of 4504	4724	msedge.exe	102
PID 4724 wrote to memory of 3968	4724	msedge.exe	101
PID 4724 wrote to memory of 4504	4724	msedge.exe	102
PID 4724 wrote to memory of 5108	4724	msedge.exe	104
PID 4724 wrote to memory of 1404	4724	msedge.exe	113
PID 4724 wrote to memory of 1404	4724	msedge.exe	113
PID 4724 wrote to memory of 1404	4724	msedge.exe	113
PID 4724 wrote to memory of 4396	4724	msedge.exe	120
PID 4724 wrote to memory of 4396	4724	msedge.exe	120
PID 4724 wrote to memory of 4396	4724	msedge.exe	120
PID 4724 wrote to memory of 116	4724	msedge.exe	123
PID 4724 wrote to memory of 2400	4724	msedge.exe	124
PID 4724 wrote to memory of 4028	4724	msedge.exe	125
PID 4724 wrote to memory of 904	4724	msedge.exe	126
PID 4724 wrote to memory of 904	4724	msedge.exe	126
PID 4724 wrote to memory of 904	4724	msedge.exe	126
PID 4724 wrote to memory of 1216	4724	msedge.exe	129
PID 4724 wrote to memory of 1216	4724	msedge.exe	129
PID 4724 wrote to memory of 4944	4724	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.bpoutsourcing.es
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a4,0x7ffb0cdcc188,0x7ffb0cdcc194,0x7ffb0cdcc1a0
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,906301834809834774,7365082806433101276,524288 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,10857475558733395499,3588561391715138761,262144 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,7706103799786769434,17730562177429812851,524288 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,7533587767920319262,3218136704712314591,2097152 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,17356812100302550889,16070943536889196856,2097152 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,16783709114624919252,8971227845399769484,2097152 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,5779284045081079004,14319239586770231286,2097152 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5104,i,7447500282090386834,16526690370317329998,2097152 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4328,i,18221008687101817465,14785483721637125532,2097152 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,5604847598497439079,16838081675855772175,524288 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,2993713397197341036,10174122322782224564,524288 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,5554640212388483331,13358736807445523744,524288 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,5554640212388483331,13358736807445523744,524288 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5128,i,7886235725251050735,7545547820273180070,2097152 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4312,i,13321462163350143437,6675066318454477890,2097152 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,5069199314686742713,10553321218391596245,524288 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,14754982188987065220,4640707106468113569,524288 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,5713705087516195422,17606426445624841574,524288 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5216,i,4784523695536975977,15930382472525518867,2097152 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,12085007653412935551,9527015398835753324,524288 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5328,i,4217378631781159526,3851302144668483201,262144 --field-trial-handle=2288,i,6046651324144087299,10164837302324788586,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b0bafa820eb6e46bd3759812dcd7ba901671ef7d96cb3a7da1538808db875ce2
MD5 714b7d44c3252227de38ee9a355a546d
SHA1 f81526aa728de20759cf5d4c8dd0a92a98ee84c1
SHA512 68f56acdd0753abac7f3a62fe8066eca5595496fc5c1fa315dad0c166507f4b48fc8f404e3cdb1ddf532c6c76dbf1119d30871bdbca0ef569aa879a280b2b452
TLSH
T1C9617E80E69143A8D39A43366DA4018B3B3A97F85C272C1116ACF4B8F70676390B00D7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b06e8c03e041194c8977e57178ef0d80105ae59bfadfae229ba89ff9805aed18
MD5 f82b0067fcb0ae7b1ac980523c32b5c5
SHA1 3dc40f4a89b7ed4eb11e1f64193b8a93dc21b693
SHA512 70df3650bb8d5843bda0482e9327e6fcc91173b4daccd01774adbad699724afb748b2d4999079ad1358b4ed4712aaf17ec5543b37ba123465481127adeb756a8
SSDEEP 48:0WrwSkorISH0xvYtSInDGEnmDLHhFOIVu0uXFbpJBNVItqix3Cy1NvtU:FlUxAYQDGtDuu1IbpJBNkDx3CYvtU
TLSH
T1EDA14C80E5D30378D7CA06365ED450A7B73A9EF81C232D02365CF079BF267A291B00A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1d29bcde474381777cd0ef1078e563535e8f3f36f6a261664432a3b139c2fd50
MD5 debe1ed477ee05a1837fcb7fba24287a
SHA1 6925b2430fefa9a2a6c2439014288e44faf7baee
SHA512 98c33da8c63d9ad60d897f25b0292ea8e7ffdfca536d6bb217a808d3eb26eedcdf095958c62ac405e510192ca179846b776d9b5b1a1d69bc02b737fe863ee4ee
TLSH
T134317AF3C7E8967EC91151F09A286F1BCE1D0946835C3C5AC5D49F1B93F6460E181EAE
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 516ba6ffa23d68777bdda3766dd14eed7209d74a1680925cf12ad668bc1544bc
MD5 b804f07b42166752829cd7f1c9ff4e6a
SHA1 7f8522d22c3cdf033314670ad8afa985f845207b
SHA512 2e620b813718bfc301e4644438dc3c97f26b78fede4cad34c0ac2d78bcd285b60cd61abc79878ad1a88e5a38965617652f7182d16e49de69f5a4a046865cde8f
TLSH
T1A9D02333170D347559DD5F934455ACCFC7A710502402D9F460F09999157545C1957141
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5968d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5968d2.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ca9582c4f78cbe9ed2a254cb83550c91d21e77a2df4250da509bde15541d4be8
MD5 48e20fa1b13c3073239eef134a733f61
SHA1 66d6315f0f57554edbfd924541ec86c4b30db2a0
SHA512 f7747bee5d38645fe91342193fb0a1d3afef4a364e73bada9001bf98b2e701cdb16de416060a3e4397e9ec9c207781cfe981b01cccdfb665bc48f68feab5f292
SSDEEP 192:sxZxaLWp/f+xsUXFIup0QH9Pb6+WNGY3Rjc0IgrJ:sxZxaqp/f+xs8JlHxgG69
TLSH
T1BE22A8516E28A97B8CC7D21DBA15BF53E6F9503191D41E4CEAFC951C04E76DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8970aede0796d54ee98eb3923de2eeb05cf0a1101f93ddc5a2e2b74382e4f837
MD5 6f8ae877c23442cf05e42315dcdc5be9
SHA1 a2c45d3417e25c862385bfbec8fd594054b7efe3
SHA512 997a1209ad8c1bef4231cf4efef97e92199d4c55ea29851989ad2cccd245e571c2b59ab8d49503b458b5dd061a71c72a117ce5248a91c70a08cd107ae22583df
SSDEEP 192:sxZxaLucBzp/f+xsiXkup94erPyH9Pb6+WNpmIT/Y3OZjc0Ig5o9ZPO:sxZxaqmzp/f+xseHmwyHxgsY/PdGVO
TLSH
T18842C652AA24D9778CC6D60DBE25BF12E7F9002299951E4CAAFCC51C04EF6DD320B85F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 67f3d27c91b16dcf9383ae7001aab04bdfae85b4b11bf6f2e3016a2c4b27ac18
MD5 f8549722cc86fec433caebd695e724e9
SHA1 c080041320ff8e555c1f3d3dac709ba8a6228577
SHA512 17d3118362784a09f2ce3e58a7d339119bc3491c950555ca455097d3daf43300b570a4ba235a5b39e98ceaba299a10fde91e8c5fa69667ffa1404031104aec43
SSDEEP 192:sxZxaLucBzp/f+xsiXkupT4erPyH9Pb6+WNpmIT/Y3Oyjc0Ig5o9ZPO:sxZxaqmzp/f+xseHUwyHxgsY/P8GVO
TLSH
T1DB42C752AA24D9778CC6D60DBE35BF12E6F9002298951E4CAAFCC51C04EF6DD320B85F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 02dfe47c17521007d2cf167ff00da5c7373b43645143fe5dba9188c5ad0abd1e
MD5 68745be6ad8b039892d5869170f239f0
SHA1 27689f7b6b6e8d41b9b35aec78e04a05afcd5e69
SHA512 b0a0e47c7f1bbba78c8cfd8cbb707b02a12206761a1ebd3e74177474959cf71b7beb61cc798d69a55895a375b3225c888eb172bfca060992dddc4efb4b150944
SSDEEP 192:sxZxaLWp/f+xsLXFIup0QH9Pb6+WNGY3Rjc0Ig5CJ:sxZxaqp/f+xsTJlHxgG60
TLSH
T12E22A851AE28A97B8CC7D21DBA15BF53E6F9503191D41E4CEAFC961C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e6765ee4641e1bf8d670844951a4290d3581c8f002106fdbb386cb0f29e69140
MD5 c6ffa2780d98552fa2ac465a8685428b
SHA1 7fdb25fba39744a3e7bd0dcbd56d83bf3e0a9ba3
SHA512 d6a2ad6fad06a209daf9bd1195e3718504fdf1c1f30e6aabfd18b1da8e8b3c9dec32c00b650035debeae873031e30d0b764d8a09c814fed183d29feedc699233
SSDEEP 768:Yy30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72ProlZMn:Yy30AbSWvS2l9u1jaLmLZ12cc
TLSH
T17DC2EA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796648D4447FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2b9a49c35e88519c44414f35568fcf4f5931f0a102210127ae0c3a024b668185
MD5 e594316c4cd2442108d212e7f09ce4a7
SHA1 9aac1cb71dd1c40064fc6e7afd74d4cf025a1f8d
SHA512 ca9c6b765cad07f5fb04e98a4cc592d44592808d37e65444ad03f69be10b4fcf9ae9cee87ebb629b8db3c0eb6a2eba5607e55a9430138934e97dcaa39d090038
SSDEEP 48:KkSIfKrSoPyZoIbK9qc0XUhFHV5nIxW+Il9nKOmmbnC/3HehJsy4nER1XlJ3Ihmm:KkSUKrSa6oAK9qiwAKNqCaQN
TLSH
T11CA1570432BE0644787D650A82758A5F634232777158E67B7F7C22A38E66E082DFDECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a29d735-b577-4b6e-8329-0c4734a895ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6a29d735-b577-4b6e-8329-0c4734a895ad.tmp
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 478fb064e9f93c74f5605fcaa5625610037d1d987bd0c30ce6778fdc24db67a4
MD5 ba7684ec37abec45bd37f15075f40f03
SHA1 75086a9447f81d7cd63f497d7c32d9fa49a43e7c
SHA512 7e457e9a0e84d8d846c5c5e8115cea01080b8cdb19a8dfb8af5f6a77da63e61cbd973d5465581caf71dc633dfd8cc81d06f2bbe8017162994a2f11163346be18
SSDEEP 384:aZcIhsNlsLpuxBcP9iX5FHtpdtgOIwZOyBod:Yh1jFa/dXsUi
TLSH
T17B827B3298B85D7B5CE7E505F58B76035FB89027DBC85F9489ED271D01EA1D8030B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b574dbc035ee7d2db1ea0f42366dbd1c1510b0b4f9b4d6894cf9929563cc750b
MD5 d262b151d24b3f25c3356a5d955d9920
SHA1 42a8153dfb6db8e149835a80c766adf4cd1d1331
SHA512 bba907ca089153e0771a7649e3805c2ad4c1f4516e9b44f319af4d192e853d2f9d63337ff36351a5e475eece1867dd44d2b3b203369c8029a7f472d06ca3bbec
SSDEEP 384:V67FiZcIJzsN/8TUNTUlIl1Lpux7FP9iX5FHt8dtgOIwZOyBod:MFQp6wgLKFa6dXsUi
TLSH
T193C22AF284D7897ADCAE9707A77E2E034EBCC067F5949A54B798161CCC960BFC306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 793742edf16de0866920daa717ff3314fd803d2940628d9f9f8c60818350a70d
MD5 1d6e64f63f6cd067ffd8ff0845679816
SHA1 9d3ba7bf9734b0872a4d1158653b172fcb8a363c
SHA512 25efd068ea337cef296e44cdd0dc3d19929f7cf82a6cbd6dfdaf43f8400f0c7d08292ce8898ed1926383f3371939b66d1c7d61cd42a0f2f670eef07ac84f6bc7
SSDEEP 384:IZcIhsNl1Lpux7cP9iX5FHtpdtgOIwZOyBod:2hYTFa/dXsUi
TLSH
T171827B3299B85D7B5CE7E505F58B76035FB8902BEBC89F9489ED271D01EA1D8030B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7897c2277c0092b07c64aa48aef086fafca31673a32837b84f62a925fbf8c67d
MD5 3998dd95c0e93ba2552c5d9d50886d95
SHA1 27c141f8e7f2d28f47956a795c26a6cd425ffcfe
SHA512 d20706afc843641c07197db5723c819ed46311c36eeb8169d23af912c4884fd5789cbdeb8421941de30fde5c5596234e48fe4ebfe53764b9a4424f05132ce3f9
SSDEEP 96:gqONkZQsjpfuMVwptaL5ih/cIPURHl8h4otop5YiCDoBIPuva6zx8X5FxVvXYvdu:LONd6AmwprQmiUy4c6siX5FjRWJi9lU6
TLSH
T1E102FB35ED686C7F8DE3AE05B54B77136FA5102BDA942F58CAE81B1C01D768C1307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0760e0baf851fd7f60251ac44ff2cfef7fe5c972f758a0d3ed6f7fa06c9180a9
MD5 689757c78c6393fc6cbe0793b68beb85
SHA1 7713ab0b77cf560243d66aebaf14aae550ddaac8
SHA512 cacdd342efef091763713577d0d1c60e0a12072b38134d3f2896152a18ac5717c7098472efbacfcac4f4130d74b4c09432c67960683e27bac87eaa529f80fb63
SSDEEP 192:LONA6AmwpVVQmiUy7cNsiX5FjRd9HKlR+q5U6:LONA6ipVz7NsiX5FHtYdU6
TLSH
T1F7122B31E8A8AC7F5DD2A551F08736135EB9412BEB896F98C9EC271C05EF19C530B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7d712c9-0b40-42b1-a5a1-c337643f445e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f7d712c9-0b40-42b1-a5a1-c337643f445e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 42e81d77ac58396263cde62886b859c996897bad1752090a5bd9a2954856df68
MD5 e732c70b6f4d8622f7efcf58428d144a
SHA1 37ff82cd100ab7e382572ca8246d1b787f25b71e
SHA512 51b2dd570b407e4baef52b297d8a43018b3370b87b676e0cbd75ae0d8be00c9e1e8682ef1ad87a0cb3b241d8cbbbfd992a92753f52ff07f995d7eb1d43ed1842
TLSH
T12D41385CB6E91149B3B76E4AABF7656E487BB8372F46C46E10110E4F0A23B40C961B33
MD5 SHA1 SHA512 TLSH

Submit Download