hxxps://login[.]microsoftonline[.]com/common/oauth2/v2[.]0/authorize?state=c3RlcGhlbkB0ZW1wc3dhcC5jb20=&scope=openid+profile+https%3A%2F%2Fgraph[.]microsoft[.]com%2FUser[.]Read&prompt=none&client_id=c858da89-655a-4c0f-b282-e20333f7f10d&uri=hxxps://honeywell[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?state=c3RlcGhlbkB0ZW1wc3dhcC5jb20=&scope=openid+profile+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&prompt=none&client_id=c858da89-655a-4c0f-b282-e20333f7f10d&uri=https://honeywell.com
Sample260930-ssledabd78

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 1 IoCs

phishing

description	flow	ioc	pid	Process
Email address	22	[email protected]	5068	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5068	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{24631391-6CBF-4D5B-B4F8-867A281C56A1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1824	msedge.exe
1824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 3716	3364	msedge.exe	85
PID 3364 wrote to memory of 3440	3364	msedge.exe	86
PID 3364 wrote to memory of 5068	3364	msedge.exe	87
PID 3364 wrote to memory of 3440	3364	msedge.exe	86
PID 3364 wrote to memory of 3836	3364	msedge.exe	88
PID 3364 wrote to memory of 3440	3364	msedge.exe	86
PID 3364 wrote to memory of 3836	3364	msedge.exe	88
PID 3364 wrote to memory of 1968	3364	msedge.exe	89
PID 3364 wrote to memory of 1968	3364	msedge.exe	89
PID 3364 wrote to memory of 1968	3364	msedge.exe	89
PID 3364 wrote to memory of 3536	3364	msedge.exe	90
PID 3364 wrote to memory of 3536	3364	msedge.exe	90
PID 3364 wrote to memory of 3536	3364	msedge.exe	90
PID 3364 wrote to memory of 4340	3364	msedge.exe	92
PID 3364 wrote to memory of 4476	3364	msedge.exe	93
PID 3364 wrote to memory of 4340	3364	msedge.exe	92
PID 3364 wrote to memory of 4340	3364	msedge.exe	92
PID 3364 wrote to memory of 4476	3364	msedge.exe	93
PID 3364 wrote to memory of 4476	3364	msedge.exe	93
PID 3364 wrote to memory of 4400	3364	msedge.exe	103
PID 3364 wrote to memory of 2144	3364	msedge.exe	104
PID 3364 wrote to memory of 4400	3364	msedge.exe	103
PID 3364 wrote to memory of 2144	3364	msedge.exe	104
PID 3364 wrote to memory of 4348	3364	msedge.exe	106
PID 3364 wrote to memory of 3912	3364	msedge.exe	113
PID 3364 wrote to memory of 804	3364	msedge.exe	114
PID 3364 wrote to memory of 2884	3364	msedge.exe	115
PID 3364 wrote to memory of 2228	3364	msedge.exe	117
PID 3364 wrote to memory of 2228	3364	msedge.exe	117
PID 3364 wrote to memory of 2228	3364	msedge.exe	117
PID 3364 wrote to memory of 4656	3364	msedge.exe	118
PID 3364 wrote to memory of 4656	3364	msedge.exe	118
PID 3364 wrote to memory of 4656	3364	msedge.exe	118
PID 3364 wrote to memory of 3452	3364	msedge.exe	126
PID 3364 wrote to memory of 3452	3364	msedge.exe	126
PID 3364 wrote to memory of 4892	3364	msedge.exe	127
PID 3364 wrote to memory of 4892	3364	msedge.exe	127
PID 3364 wrote to memory of 4892	3364	msedge.exe	127
PID 3364 wrote to memory of 1824	3364	msedge.exe	131
PID 3364 wrote to memory of 116	3364	msedge.exe	132
PID 3364 wrote to memory of 116	3364	msedge.exe	132
PID 3364 wrote to memory of 116	3364	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://login.microsoftonline.com/common/oauth2/v2.0/authorize?state=c3RlcGhlbkB0ZW1wc3dhcC5jb20=&scope=openid+profile+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&prompt=none&client_id=c858da89-655a-4c0f-b282-e20333f7f10d&uri=https://honeywell.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffa8324c188,0x7ffa8324c194,0x7ffa8324c1a0
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,6952490609794780585,18428135217130916623,262144 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:2
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,469165085078651541,872827980152806941,524288 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,11675893627966156942,10984671647637885881,524288 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,15086652490397398573,9855026072556008907,2097152 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,9490549144475963795,7149017663247349215,2097152 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,269092974830253670,2410813491494417596,2097152 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,1554796077773206302,13361068558027150090,2097152 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,8677641514909473113,10080333357834137559,524288 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,17859452634632154760,4004269198786057882,524288 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,9048297244625471177,2958445884353553456,524288 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,9048297244625471177,2958445884353553456,524288 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,9518091025846646773,9276481392467469239,524288 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,1752219725737306043,3250354061131128479,524288 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,17301783031760645129,3719357106891645951,524288 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3464,i,15733692364799862322,1820399452480740668,2097152 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=2600,i,14618487593288372757,8547905634814596409,2097152 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,13707778808771778488,9894006006261674248,524288 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4524,i,1884020873069658533,3537627024973822661,2097152 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3520,i,9970167824492001741,12091238113053966099,262144 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5220,i,14378783466036274288,3727564301148662983,2097152 --field-trial-handle=2980,i,7264488499205477537,4873007443123925677,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

786ce973-9357-41c0-a4e4-cdff7a4dc682.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\786ce973-9357-41c0-a4e4-cdff7a4dc682.tmp
Size 9KB
SHA256 8783eaaae3001d2b75df3d2b6797480df8c057161d1a7a924c0c5516220b0f91
MD5 1539201f041886cefef6f02a937c7722
SHA1 94d30073c3dc8833b6f669d52c275a0f6b3f620d
SHA512 9b5c515cfde6f4f6352e2c0262c98893a144c7528c8979714ba76998570046dca14414b5239942fcbf60305e7144356c794e29c2af96058ae265ff0e56bb32f0
SSDEEP 192:sxZwRlWt/fSsUAUIdpJHW6+WNGYa0JqIgrJ:sxZw+t/fSsUANJHbGH9
TLSH
T1AD1295516E28A57B8CCBD21DFA65BF43D6F95032A1D51E88EAFC961C04E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8e7c490bcc8ef0fba1cc40d75081dbb2fe2e0f168aeb38dbb1941d3ef10d94ea
MD5 1f885d09faa7cc27df1d8ee18b27ffe8
SHA1 843aafbe0cbac593211e84ebcb0e1d3a15a43365
SHA512 a8204549673c3b3658b6d30556d7e92ab0b185b3ab6edc35aa3d1f7bb09ee619d747b8fa84e1d7a0cf83468124781f7e3f38bd0895fea69279f6f94b89a4c489
TLSH
T1DC6142CA5ED0287BFF6865B0C1FD154B3B3034B045A31F5A28E6F8741E8D7892D96238
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e663.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e663.TMP
Size 3KB
SHA256 3d8abebc1aa28e9570ea2fe0c442fab7ee6aa56ac3b8dbbae9f28b26284ea289
MD5 4a7d006eda284e1d61bf6188741f5f32
SHA1 6e4324e8c08711356d0deeaf9cd60f0996b024f8
SHA512 6d9fa95215c0ff6831e1fa91d7c4eceb13795e691cc1cce54c676b1e151af2d6301dd4c86017e056c629313d5e4a0fbe069039d876591582dc74c7ba9a92f449
TLSH
T16A6131CA5ED0287BFF6865B0C5F9154B3B3074B045A31F5A28E6F8741E8E7882D96238
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 c7ece5975ab5ec63d6a57f8132e791f02fb83ec63d43b8452b4c8819ac482bae
MD5 efddd504dd37cd73c2b288e3a6dd05a8
SHA1 fe9bc0f63f585c731c5f20115454e2a7640dc112
SHA512 dab160faf20533ead24082f199fba07642b770ae59374b059e24db68464cc03ce4381e0a086403c99eeda945c8763c5c2f2193f2606aeaea740174634febc655
TLSH
T19D117AF3C3D586AE891156F09A28AE2BCE2D0606421C7C59CAD4EF6BD3E3475E10259B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 19ff93af7b8f7c3b324d21a74d0206ece95110079a48fa60bc95bdffd08723e9
MD5 87a5f5c53e935aff8b0a39a3ed895ac4
SHA1 1523339cf07816aa8cb3ee89446cbc55bd3ddb71
SHA512 4453e0ec486611d928a2371dd6f85fa2dcece5e3fd3f910e709fee10e6fa873ade10d765bb89e5632cd9e4809a342faef753f5cb54ce1c9d89a421354064c57e
SSDEEP 192:sxZwRlWt/fSsmAUIdpJHW6+WNGYa0JqIg5BJ:sxZw+t/fSsmANJHbGHl
TLSH
T17A1295516E28A57B8CCBD21DFA55BF43D6F9503261D51E88EAFC961C04E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 e2fba90df240207e5822648b51baf4098f10bdb84417ba0e492338e80d70ed08
MD5 4a9771cfd45c2467937dd59b2ef1913c
SHA1 cf593b168b3c0adde2bb969b228bf75678a46fbc
SHA512 43d90cd6c0cc6dedebbde8333a3612922d06ada818330bcf6e85efa3ce865cd1830af44a9c23f5fc949ff5fb49562ffc50f1ccc1247a9d47b7567a74bbfee36d
SSDEEP 192:sxZwRlWt/fSsUxUIdpCeHW6+WNGYaRJqIg57J:sxZw+t/fSsUxNBHbGGL
TLSH
T14122C7517E28A97B8CCBE20DFB55BF43E2F9503251951E88EAFC861C05E7ACD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5b2fc096e6d90c2742be681d8fb5edfbe391a1fdf01d9c84111f0fb70a49be80
MD5 031f9b58530028aa8d6d01ad33090951
SHA1 23fb18e4ce08f1148c074a888b4fc66b0a5acbdd
SHA512 55a01896611b65f2fa23669c61f7f6701eaa0f3c3e71c290c57a53d4f1c2e3b204cd66abe84eb6fb0e13c15e2c4fd8c878f3302a5d79f24b9d78277978045c27
SSDEEP 192:sxZwRlWt/fSsUxUIdpAeHW6+WNxf9/YaPJqIg57J:sxZw+t/fSsUxNHHbP/kL
TLSH
T1E522B8527E28A97B8CCBD61DFA55BF53E2F9503251951E88EAFC861C04E7ACD1207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 34a9c8a649f58e40183cf869c5c29d2a16dad2bf4e276a11659e4c518ed88239
MD5 ca14b7ee002db7dab47ca982a0f9fc25
SHA1 7a62ceb495c35c6259a60af586fa975f14ad7041
SHA512 b77bf0e895dbace44b77ed9de398265d04fe042724a106e20dbed40becaf0c9291ed7a0e7730123460d249f0d84be8a60b0409bcfcbe1b9b820882a76597a477
SSDEEP 768:/kyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3wroXZVwv:/kyQRbrWvvlpZu1jaXKLf33bXZVwv
TLSH
T1BCC2E92F640CCB7E4FC01E9DDC6A6F976EA802C766588D4047FA994C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 34688d310fb4aa04e1ef162d2a25f0b161d8383d7ae7fe7fde0e3b1adfd49644
MD5 60066a3aec6bf1b8e7df482dda8ba8a7
SHA1 65aa3bf47a90f2d18f665ca550daf303ad3d6c24
SHA512 ac940d732e043b85f5b071174ae8112a884634d0ee34d716ebbeb1514762195d3275db8620b8a123e4e299a7a9172d68c950df3ed4727e897c1d4918020bea64
SSDEEP 96:KgHmKQou6ucK3q8t0BdnDfkvDePh1kKJBht/2KQY9:AV3lt0BdnDfyDeJ1pBhMQ
TLSH
T1A1A10551307B0640397F259881AAD75E524131B33058FA6BBFBC01E66E6FE085EFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2b52780-615f-481b-a0ad-3da99539f520.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d2b52780-615f-481b-a0ad-3da99539f520.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 12d8766b31815b522347e323b90a7b7727ccb23d78a732230eb31a97943a62e3
MD5 84aaff8c7102aedbda2c1aa7b8227e2a
SHA1 b933bfd284cf8de842d360944f15c7347734b845
SHA512 de00faaeace905012f7ebe36dc9a93cc947501f51bea08caa98dea013256896d58e757f7353490d5a0918d9685bcd18f8bf363c05cef0658f4a4c05cf0c6e926
SSDEEP 384:AZcIhsNtehJ60eU4p5u8ijOBoXtgOIwZOymL+oP:+h3J7yknXXsdKQ
TLSH
T18A827D326C786C7A6DEB9551F58737035FB4446BE3C86B84D4ED971D00EA2D8030BE12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 a6c94b12a906d5ff019ef8c909929e30e8e3a42ea178d689a23c9274df0fc7b7
MD5 a87e62b4fb1e828dc0764ea2442653ef
SHA1 f5ae468df7c6350ac884c816b7adfe0721201119
SHA512 30f8ec051b8c49b244674f04b2880e33adf235760b6f3be0e54ed9147ebfc0f8561047000cba516363d02321386cd3e5367c15057e430c8f72b2384fb8b95394
SSDEEP 384:miFiZcIyzsN38TUNTUlIllhJ60eq4p5u8ijOBDXtgOIwZOymL+oP:NFQaqwgJJ5ykKXXsdKQ
TLSH
T177A25B3358A8987FADEB9E45F68A37038FB44067D6C5AA94E6DD9A1D00E71D8030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 60c8df74142a9b868dbf85aadb8dd8ade3617092042db00735d2c39927f795b1
MD5 965851fc30c2075625cb2df48d7934b1
SHA1 b3759c488ef87288203eacb4b50ac5ec6af53130
SHA512 edcfbdf06ce1daa3636fae0f794f790699407d4a2baf554e4c9f55a7c3da2f2c0f5a72a5e13b40bd3a33647576dfe443d6da455ec2e50e87b42936cff0508567
SSDEEP 192:SONV6iDCQmiUyCYHq5u88PjaSqGrcpLU6:SONV6/oHq5u8ija5LU6
TLSH
T1B502E739BC783C6BAEE3AE05B5477B175FA4013FE6952F84D9E81A2D01D729C1307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c51f9837dc414a21abfe169f1b46f5c8591c0fc6402474cf4c5e6de4f4b0216e
MD5 3772b21924655f0d8c6493a61e05d36c
SHA1 dcae75e5ffa898175fb26a73f20b67d4ad27c4e3
SHA512 1485a07256cbfbaed543f92c47c8c960a85d557c2942d13b6498b9c8eb4c78abe0bda3a42804872fd3833d8f3fc4212ad0e6d04fd504b5ea6a3ab08072828711
SSDEEP 384:RZcIhsNtlhJ60eU4p5u8ijOBoXtgOIwZOymL+oP:5haJ7yknXXsdKQ
TLSH
T160827D3268786C7A6DEBA955F58737035FB4446BE3C86F84D4ED971D00DA2D8130BE12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 886f2840686d49e10b4abd43574b0e45c1109826ea28bb657d9bdd5a3181fbd0
MD5 a117404ca68cfe52a9e50a898baa4652
SHA1 e4d90b9239a921fc1e54a67823b38fb8445d7b0e
SHA512 7b9a760fe31cd4c6b0c5d03be1a729d13a102cfe5f292c4ee1cd23525b9b9e90f922d4acf47eac34efec8b020cb62d6e7f6cd4503d1ac3088153e3d92df42f7a
SSDEEP 192:SONQ6iDmQmiUyFfYIq5u88PjO7F/uZGEqYU6:SONQ6DlIq5u8ijOBaXU6
TLSH
T15512F836A8B87C6B6DE3A950F58736175EA5422BE7893FC4D5EC172C01EF29C130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abeb12e1-95ea-42c1-8d27-295b1431f7a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\abeb12e1-95ea-42c1-8d27-295b1431f7a0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 63b090c20f8eefd0a1187b40c80757265441271f7c2de57890ff4bc646bac6a7
MD5 887364187fcb6bf151419d899e8ae1c0
SHA1 7ec03af9a9f9053752061eab8d8d34f22fbc12e2
SHA512 f8d7faad745f302e4f70daa900439996b53135086cce41e87561c7a06ccfcb26dc135c811e15ed65b9bfa72a6930aa69e3841428978e12864f924fa27adce2fb
TLSH
T1BF412C58AAFA1158B3B37F5AAFF6A86D047F79732A0BD56D10110D4E0A63B04D861733
MD5 SHA1 SHA512 TLSH

Submit Download