hxxp://kellwell-my[.]sharepoint[.]com/[:]o[:]/p/perry_tn/IgAIJPGAXYu3RIzU9Pfw3L_YAU0wU6qb86smWQKMS2X1Z58?e=gxK1SV

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
59s
max time network
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://kellwell-my.sharepoint.com/:o:/p/perry_tn/IgAIJPGAXYu3RIzU9Pfw3L_YAU0wU6qb86smWQKMS2X1Z58?e=gxK1SV
Sample261007-y23mxafv5q

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4636	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{7D572BA2-48D9-40AA-9292-069AA5EB0A2B}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 4468	436	msedge.exe	90
PID 436 wrote to memory of 840	436	msedge.exe	91
PID 436 wrote to memory of 4636	436	msedge.exe	93
PID 436 wrote to memory of 840	436	msedge.exe	91
PID 436 wrote to memory of 840	436	msedge.exe	91
PID 436 wrote to memory of 4528	436	msedge.exe	94
PID 436 wrote to memory of 4528	436	msedge.exe	94
PID 436 wrote to memory of 4536	436	msedge.exe	95
PID 436 wrote to memory of 4536	436	msedge.exe	95
PID 436 wrote to memory of 4536	436	msedge.exe	95
PID 436 wrote to memory of 4216	436	msedge.exe	96
PID 436 wrote to memory of 4216	436	msedge.exe	96
PID 436 wrote to memory of 4216	436	msedge.exe	96
PID 436 wrote to memory of 2812	436	msedge.exe	97
PID 436 wrote to memory of 5548	436	msedge.exe	98
PID 436 wrote to memory of 2812	436	msedge.exe	97
PID 436 wrote to memory of 2812	436	msedge.exe	97
PID 436 wrote to memory of 5548	436	msedge.exe	98
PID 436 wrote to memory of 5548	436	msedge.exe	98
PID 436 wrote to memory of 3684	436	msedge.exe	100
PID 436 wrote to memory of 3684	436	msedge.exe	100
PID 436 wrote to memory of 3684	436	msedge.exe	100
PID 436 wrote to memory of 5740	436	msedge.exe	101
PID 436 wrote to memory of 5740	436	msedge.exe	101
PID 436 wrote to memory of 5740	436	msedge.exe	101
PID 436 wrote to memory of 3080	436	msedge.exe	102
PID 436 wrote to memory of 3080	436	msedge.exe	102
PID 436 wrote to memory of 2400	436	msedge.exe	103
PID 436 wrote to memory of 2400	436	msedge.exe	103
PID 436 wrote to memory of 4228	436	msedge.exe	105
PID 436 wrote to memory of 5888	436	msedge.exe	106
PID 436 wrote to memory of 5888	436	msedge.exe	106
PID 436 wrote to memory of 5888	436	msedge.exe	106
PID 436 wrote to memory of 5252	436	msedge.exe	109
PID 436 wrote to memory of 5252	436	msedge.exe	109
PID 436 wrote to memory of 5252	436	msedge.exe	109
PID 436 wrote to memory of 3384	436	msedge.exe	110
PID 436 wrote to memory of 3384	436	msedge.exe	110
PID 436 wrote to memory of 3384	436	msedge.exe	110
PID 436 wrote to memory of 2568	436	msedge.exe	111
PID 436 wrote to memory of 2568	436	msedge.exe	111
PID 436 wrote to memory of 2568	436	msedge.exe	111
PID 436 wrote to memory of 3224	436	msedge.exe	112
PID 436 wrote to memory of 3224	436	msedge.exe	112
PID 436 wrote to memory of 3224	436	msedge.exe	112
PID 436 wrote to memory of 4312	436	msedge.exe	114
PID 436 wrote to memory of 5204	436	msedge.exe	115
PID 436 wrote to memory of 1364	436	msedge.exe	116
PID 436 wrote to memory of 4540	436	msedge.exe	117
PID 436 wrote to memory of 4540	436	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://kellwell-my.sharepoint.com/:o:/p/perry_tn/IgAIJPGAXYu3RIzU9Pfw3L_YAU0wU6qb86smWQKMS2X1Z58?e=gxK1SV
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffdb490c188,0x7ffdb490c194,0x7ffdb490c1a0
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,17508414020788116892,7874849151068057919,262144 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:2
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,14821851281784307503,3927156696110702646,524288 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,8662322145216084104,6027887459539031207,524288 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:13
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,5769449522803231379,18001431384160349374,2097152 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,3954764614752922447,13369634482135110378,2097152 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,10341138355866055972,2703879594957264208,2097152 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,15355770832725224543,4669685787713841452,2097152 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:9
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5304,i,13868283685894648644,7397131517427892750,2097152 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3648,i,8073027669327824848,15153370946524944554,2097152 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,17016577405230514114,1952480416712378286,524288 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,14244917153219482143,12044861209627604354,524288 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:14
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,16669390159436813361,14233049267942665389,524288 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,16669390159436813361,14233049267942665389,524288 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6432,i,6077496626087664452,2361089382361278192,2097152 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6876,i,1048801856074179337,1912746385219397179,2097152 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4776,i,2833836113584687167,14337838059089555591,2097152 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4948,i,4624939514379984671,2626638223956516232,2097152 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6224,i,3041601566909288785,15492455095195982429,2097152 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,8418038264656473935,13921603698776012957,524288 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,3120361943145842246,4809941784455961426,524288 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,5475367778941663895,426708739868892249,524288 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,2726508020499613923,3356535422706983773,524288 --field-trial-handle=2928,i,18393222368439595896,3051332215714252225,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:14
  2⤵
  PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

51b4578d-2ffd-4725-b826-3fe2bbcfcfab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\51b4578d-2ffd-4725-b826-3fe2bbcfcfab.tmp
Size 34KB
SHA256 16339b14de36ce1582a180f17e4835cfa96093e2fff117715f6c9ac6d199ea4b
MD5 7737fb09a7b7e6b6dbdfc4aa24152b4d
SHA1 2407dbecc49dfac27f2c260c5bf795391749fd8f
SHA512 edb28e1f4e9acb896373e057e8d9d1d98f45a2643010caad88a31920da64e7f1043e19a5279f3c5c00f0fd1de4cdc155c05adc47acddb13d7595546b9a18a4d1
SSDEEP 768:XR3hfy6KgtlwsE57Y0GZxJsXBdK8ZSS5RLV:XR3hRwb70/JsXf7QMRLV
TLSH
T17FF2BF30D8A18DB35DFBD3D17A0A7657BEF885B3C6C84E58D5E99B0D00875AE030B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

984fabbf-420d-42bc-aff5-64d196d804e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\984fabbf-420d-42bc-aff5-64d196d804e7.tmp
Size 37KB
SHA256 f0aa44416e19e762da06b8fd895e7893403cc6284a071cdb389cc05aef5abcfa
MD5 37bf07a4b7719f9fba612d52f61a066a
SHA1 cdde1fd557ff8ab6c74b0ffe9ddf5d1512c98d97
SHA512 6577db8cea3e684a8c7a47732b605be5d2a64a831f26eef6703501da254385f6ec074cc220af6ac938c35dee3b7de257bd1cc6bb9e23159a348911eedd33e30f
SSDEEP 768:A/UxvxjgC+I3vfKgtlbE57Y0GZxJsXBdK8lRSHUPpMs:tZj3+I3Ny70/JsXf7rSfs
TLSH
T11903C034E8909D735DF7A394360E7387EEF445B3C5C55EA88AEE6B0D028B26D030395A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

924e7c70-65b3-4bbe-a927-9e86d80de28d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\924e7c70-65b3-4bbe-a927-9e86d80de28d.tmp
Size 105KB
SHA256 570534a1f6b0d6e8db418fa553a414458a3e0f6b0a0024d7201973760ddbf255
MD5 0b3ffe2c06e4d094a9d1092680cbfc1c
SHA1 85b979356197a977135b99f51b60f3cd84c7cb98
SHA512 6d2cb96f1e1e973b36c47ef4a65118a190f089bfdebe3a4cef1c054ebe8a30cceb7a03ca571fc38ebf7a375b4ba469acdd7653d509793d6763e8e4fc1c777957
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7I:fwUQC5VwBIiElEd2K57P7I
TLSH
T111B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

21952474-fa96-46b9-bf7a-118383cb180b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\21952474-fa96-46b9-bf7a-118383cb180b.tmp
Size 11KB
SHA256 36fc0dbd25e8479e4baa6f388d866586e2a0848374a8a0049edcaae942c716c0
MD5 fada5584f0267fbac1d1aaac6d16002f
SHA1 57a227e79f71a3c38bbf28450468882a72e08124
SHA512 8b35f9c2f165d4d397df72869a77c1991d6abc80d97797f5f3540891374411384aec0700df73c4eb95574db84a2325caa1e629c367b7bdc4b070de3b647f08cc
SSDEEP 192:sxRnRXb+/f6sGNKF3zoA8pAN/g6+WNPY3/YU2j359GAIgIJ:sxRnh+/f6sGNKFeI/50/Ks
TLSH
T1CA329715AE28A97B8CCBD21DFB567F53E2FD1032A0915E58B6FC9A1C04E66DE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f34e029-8873-49a3-8757-93f4b5fc52ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2f34e029-8873-49a3-8757-93f4b5fc52ea.tmp
Size 11KB
SHA256 90d4d2617c256b60feb6cf47a1090a6db88e72ee5c0c1ed68151ec16adc072ee
MD5 fbaa183a836bf4b97e695f7a572602b7
SHA1 cafa5f702ce3b877981bfdba84ee597c2cb3a9c8
SHA512 66723c41831c8b3e44dfee1c2d5d50364eac3f64f564302e7692fa99f21d35feb5af4485df7158ab32feaa67a32404366d36a139dda253b413461b3a091be96d
SSDEEP 192:sxR0RXb+/f6s7NKF3zoA8pAN/g6+WNPY3/YU2j359GAIgDgJ:sxR0h+/f6s7NKFeI/50/K4
TLSH
T146329715AE28A97B8CCBD21DFB567F53E2FD1032A0915E58A6FC9A1C04E67DE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

783b88f5-9a5a-4cbd-bd08-0dc2a3f411be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\783b88f5-9a5a-4cbd-bd08-0dc2a3f411be.tmp
Size 23KB
SHA256 b8b62055a0c78a09a5850d72e30f7f5353214ad6ef11595e7472e01bd4f86897
MD5 42984918cccbddea8077e059651c43a5
SHA1 6d72af84b988daaee2571f36d18124089daa2885
SHA512 064e55132412e45200ec6f1f4e749c1d387d28991405a067cd062b63b545d5bc6584074d39c674808d12c883dd7554ec87cbb89fbb4b7acb501a71a81c65215f
SSDEEP 384:64qajXwfCtgmcFfsO7nKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV+a9mWRuiCry:6JajXKWgm0fsO7n8F1+UoAYDCx9TuqhL
TLSH
T1E7B2CA3B640DCB7F5FD00AAD9C19AF976D9802CB96588D4047FE984C02C77FA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b6aec3439e4192a6ea679685f2f683359791a022426a9ba8b9dd2bf80a9ccde3
MD5 274b51a3e0b55bbf063725395b36eb86
SHA1 cfba43a74b6de3363a5f84fbf116469d4bea6f00
SHA512 3371889b9f45200d97aa65589ec7fca230392c032c16384632c9ac95e3a0c7490b8efd94efdd91bfb831ac94f10d96a93d37b7db5b4b3a6cb3f845f98d531bac
TLSH
T129E026F444CBC32FAA4864C701AC6B5C83C1366E93C0BB4E2B40C588770A484B383AA0
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a
Size 39KB
SHA256 92653e2e73b9dd4e3fc534a6c40778531e0f8cba409e5425cd46c175be42a228
MD5 78ebd023781562fa296bf5d79fc089f0
SHA1 c12377abf862a4d6d7310ef2c466e68d119afdc2
SHA512 e8b4c3343c59a4d9660259dd9b3029922f6ded78e74f54080fea54f3015f0772153744a6b37dc57f39724e19abf46d898d7c4a7a7f12b80eb56ec8dae11c0c47
SSDEEP 768:soGIz+DwGHYNAJ/rXvxN8Ycbmdc1Gfcw+XdtcNJynJnfbhxw:soGc+DL4aJDXvUYcadfcw+XANelfbrw
TLSH
T13603F1233151D0ABDE047B415BC3C7516F38D5A949028EB288FAB624CF975DE836D2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 62KB
SHA256 df705d05526a9843e7e6f2eadb772224c6382380e32b107ef8ae1b67ea6de5fa
MD5 cd26b734c539d2f40452fbab3b4a8e10
SHA1 d8c2bd26f4b9f223149000d168b19eb5f7d19319
SHA512 63f7c2833af53c878ad0f97ff306c331934f0a2d15826e65c29d0c4acd871f1507b72f3e04db32702c741384d7a64463eade15abaf6346bd8d99a94c3066b802
SSDEEP 1536:2ym+/5q+gAfjGYiB3V8+BQ3brXNICdsxPLSK99WKK0IS55USjMNKw:f9/jGdBF8I2vWPLNLWh0L5/js
TLSH
T1835302D7B99BF5CCA29006F28A62EB705FD03B2345A1741BAE7375C92DAC234496B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 167242c599b994e1d1e8b5231447ab7f979c3a277cffaa208e489f124ad82e8e
MD5 da923e100211e8cae6994fc01fab72bf
SHA1 406ebf583949a4b264d8fa03304db5ff63b8bfbf
SHA512 eb00b36260cfd41e1e78cacc256932b1cb8822bd2c1bad9d1c59876c9476197f1f08382c59be167aca93ba7869755447fe4fd389179ce12796c1bdabc3da6cac
SSDEEP 96:SXCWQw8ewYNng4F9LS1BRVLLSBQNQBE0joYpthAqZ6FWJxS24khD6j8cjdv8n5jD:SXEwptKEoYpwqZf4CEwrnaqFZ
TLSH
T190B16116D2D298BAFFB840B905CC4D563B74798324F2EB83816DD9747C5F3D91188369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df3a85c9-c48a-4377-9e2c-9587e0110630.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\df3a85c9-c48a-4377-9e2c-9587e0110630.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

c9807540-9c93-4ad4-983c-ae3158281c2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c9807540-9c93-4ad4-983c-ae3158281c2d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ea0aba63-67b5-4e47-bb2c-6bf447c6ce74.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ea0aba63-67b5-4e47-bb2c-6bf447c6ce74.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ad849c48f346ebd9cc4f0b0749c3ee6a4a70a6db0825b7b08c1ab18c48db244c
MD5 47a91010ef8e9f631a70e5736dc387e3
SHA1 fca6f53c5049d9c29452db08fdce02424585a7ef
SHA512 3d983200b7de6ab68a302ef81501a2c6013cd957032d3fc8137747a0189b49badb3d44fba907c4edc76e6a6ae632799d698e01c27d4b6362123f126a044a9c9d
SSDEEP 24:KR38jAnI/KjhO1aS6lZfyXLs7sIqIRKIhU1aSdqAa9acIIJK2h41ySX8pyXmtua:K8cI/KFOc9fy9lIRK+UsS/IJKg4cvyK
TLSH
T19E91E860B57B5200383D394951E5A66F035331F3B428A5AF3FFA41A19E2AE544FBCCE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b6e519af-c79b-43ba-bc10-c052ca4f7717.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6e519af-c79b-43ba-bc10-c052ca4f7717.tmp
Size 11KB
SHA256 cc7e590287e5f1ebb368ce29a7433cc7ca2e9045fde4bcc93e55e1f017539bac
MD5 54ba399a61cba6a04c34743a8941c086
SHA1 c76c5029c66cdf310935f30fc122dc5494c910aa
SHA512 ff9ffc7128d9cf8ca9ac17d3b8c871b9dc00cbc35a5d2a22244a134e23bcb5fb3383d14e8f1914d806f441cb65b86267e45417d737fb23b0b105f58e51385ce7
SSDEEP 192:sxR0RXb+/f6s7HKF3zoA8pAN/g6+WNPY3/YU2jo59GAIgDCJ:sxR0h+/f6s7HKFeI/50/by
TLSH
T16E328615AE28AD7B9CCBD21DFB567F53E2FD1032A0915E58A6FC8A1C04E67DE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4b6807a-12fb-4b75-9164-a3d72e221049.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d4b6807a-12fb-4b75-9164-a3d72e221049.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f6463659-5230-443f-a133-aa7ba280f119.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6463659-5230-443f-a133-aa7ba280f119.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1cdf483-c161-4612-ab4e-1d8cb6593374.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a1cdf483-c161-4612-ab4e-1d8cb6593374.tmp
Size 34KB
SHA256 389b08353aac2cbc73cb99ad96fb350bebe37fcf76762c125383a394150c20f9
MD5 6622bb5e5915e5c9516597e6665b8d4f
SHA1 06e3af6ab7c3b5610413a0ad29acbf761b44b33d
SHA512 7eee5b6edd978dccc837fa5802d54d69ba5a4bc0040876e2c75227ff8921109d27909de5aaf5794d0232feeb1d59881d83ecbc3b397b76368587a48014b7c7d1
SSDEEP 768:vR3hEy6KgtlwsE57Y0GZxJsXBdK8ZSS5RLV:vR3howb70/JsXf7QMRLV
TLSH
T116F2AF30D8A18DB35DFBD3D17A067657BEB885B3C6C84E58D5ED9B0D00475AE030B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a44dd90f-f2cb-4c06-b8b9-99ec67f4ef1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a44dd90f-f2cb-4c06-b8b9-99ec67f4ef1c.tmp
Size 40KB
SHA256 acf86d2dc9e4e36c293e344304768065b4d82c1758a72a569d48751557cace76
MD5 65d345dbd5ad7052ab9b0074645e34e5
SHA1 84fbc7f6f438e5d697a34d17dd31e817c144eb4e
SHA512 0f86eefc727c6986924bf281178417447ed201741fd12cec2b38d5777d370e276b91b7c2a67fc43ba378f52f2dd0d5a952481b44dc8b63a1e6d690cf5cea0997
SSDEEP 768:T/UxvxjgC+Q3hGy6KgtlwsE57Y0GZxJsXBdK8ZSS5RLmA:mZj3+Q3hOwb70/JsXf7QMRLmA
TLSH
T17D13C035E8649D635DFBE390360A7797FEF445B3C1C54D688AEE5B0C05872AE030B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06a8440b-4313-458e-8edb-d952fbf02ab8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\06a8440b-4313-458e-8edb-d952fbf02ab8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads