hxxps://jira[.]viasat[.]com/browse/TIDE-2606

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 21:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://jira.viasat.com/browse/TIDE-2606
Sample261012-1vdfjsbt4k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3720	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{807AFF2D-B963-4FDF-A51A-678A81B22313}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 4608	1720	msedge.exe	85
PID 1720 wrote to memory of 3720	1720	msedge.exe	86
PID 1720 wrote to memory of 3824	1720	msedge.exe	87
PID 1720 wrote to memory of 3824	1720	msedge.exe	87
PID 1720 wrote to memory of 3824	1720	msedge.exe	87
PID 1720 wrote to memory of 4696	1720	msedge.exe	88
PID 1720 wrote to memory of 4696	1720	msedge.exe	88
PID 1720 wrote to memory of 2484	1720	msedge.exe	90
PID 1720 wrote to memory of 2484	1720	msedge.exe	90
PID 1720 wrote to memory of 2484	1720	msedge.exe	90
PID 1720 wrote to memory of 4656	1720	msedge.exe	91
PID 1720 wrote to memory of 4656	1720	msedge.exe	91
PID 1720 wrote to memory of 4656	1720	msedge.exe	91
PID 1720 wrote to memory of 3620	1720	msedge.exe	92
PID 1720 wrote to memory of 3620	1720	msedge.exe	92
PID 1720 wrote to memory of 3620	1720	msedge.exe	92
PID 1720 wrote to memory of 3164	1720	msedge.exe	93
PID 1720 wrote to memory of 3164	1720	msedge.exe	93
PID 1720 wrote to memory of 3164	1720	msedge.exe	93
PID 1720 wrote to memory of 4632	1720	msedge.exe	96
PID 1720 wrote to memory of 4632	1720	msedge.exe	96
PID 1720 wrote to memory of 4632	1720	msedge.exe	96
PID 1720 wrote to memory of 4800	1720	msedge.exe	99
PID 1720 wrote to memory of 4800	1720	msedge.exe	99
PID 1720 wrote to memory of 4800	1720	msedge.exe	99
PID 1720 wrote to memory of 3088	1720	msedge.exe	100
PID 1720 wrote to memory of 1656	1720	msedge.exe	101
PID 1720 wrote to memory of 3088	1720	msedge.exe	100
PID 1720 wrote to memory of 1656	1720	msedge.exe	101
PID 1720 wrote to memory of 764	1720	msedge.exe	103
PID 1720 wrote to memory of 4540	1720	msedge.exe	110
PID 1720 wrote to memory of 4540	1720	msedge.exe	110
PID 1720 wrote to memory of 4540	1720	msedge.exe	110
PID 1720 wrote to memory of 2632	1720	msedge.exe	114
PID 1720 wrote to memory of 4712	1720	msedge.exe	115
PID 1720 wrote to memory of 3240	1720	msedge.exe	116
PID 1720 wrote to memory of 2548	1720	msedge.exe	119
PID 1720 wrote to memory of 2548	1720	msedge.exe	119
PID 1720 wrote to memory of 2548	1720	msedge.exe	119
PID 1720 wrote to memory of 632	1720	msedge.exe	126
PID 1720 wrote to memory of 632	1720	msedge.exe	126
PID 1720 wrote to memory of 2720	1720	msedge.exe	129
PID 1720 wrote to memory of 2720	1720	msedge.exe	129
PID 1720 wrote to memory of 2720	1720	msedge.exe	129
PID 1720 wrote to memory of 5016	1720	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://jira.viasat.com/browse/TIDE-2606
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9f6afc188,0x7ff9f6afc194,0x7ff9f6afc1a0
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,10482303001019341167,13608009316287105459,524288 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,17226278185912708597,9218291895782071851,262144 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,15217748695430990887,5024802865487045968,524288 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,7315402271832509643,11164052962850097045,2097152 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,15607706831118897583,18042851857525849007,2097152 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,2286891888833707823,17706923380617164310,2097152 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,3339712504670283621,10637045820052565344,2097152 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4968,i,160276224421608610,11981369016298596807,2097152 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3672,i,10047679176148047973,10564671681342989198,2097152 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,1771088104890057811,518492404439239541,524288 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,12792541694538070528,10268766711369572581,524288 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,1892721177972015669,14817880292829532161,524288 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,1892721177972015669,14817880292829532161,524288 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6236,i,2325353097466772691,4362559770172399738,2097152 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,9570556250869414644,16836962036189167598,524288 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,2739203932167101485,10023480736181028177,524288 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,16101417382624011979,8913956420023699610,524288 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5020,i,11257605623023657681,5782487870226914113,2097152 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,1184892141167462949,2518855431351697983,524288 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5272,i,17286283987670439850,3777765262390969928,2097152 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5484,i,6123844050821505622,55195004199197228,262144 --field-trial-handle=2300,i,14846459751301785922,10696731843126491469,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3cd7e654-885c-4bdd-a131-a427aa0ad90e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3cd7e654-885c-4bdd-a131-a427aa0ad90e.tmp
Size 18KB
SHA256 c810d9e9e9121ff59f600a1741e133fc35d11c314be73ce3087f81fc5651a28b
MD5 fbf6130dc4c561737d42b7d1e9a9f78c
SHA1 251aea09766f48b8d56fa930c7a6a9267acb7958
SHA512 b13eb00869d395f284810d427cfd0f7b51bc355e2248656460c081515a2d4d8f9de89d607c7e2cb3e7c1421dc45caeeca4e5991dcf58a5afcb2140a1deec84d6
SSDEEP 384:rZcIhsNxEoHD54o318BGYX5EzyOi6Q9lfi4/uANEbEeUM:zhKDxGGYuzyO3Q9xLJCbETM
TLSH
T170826C72ACB4AC3B19E7A645F84A35178FB8E027F6C46B94D1DDAB1D00DE5A8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74aaf138-5a5a-4c7e-bc2d-f6ccb9a24fca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\74aaf138-5a5a-4c7e-bc2d-f6ccb9a24fca.tmp
Size 18KB
SHA256 6cc62b68114b50c03da07d4289ed8fbdcc65019f175cc3ec8d972afa500d1777
MD5 194e4adc4a79af23ea80081ae3bfa09f
SHA1 b3eef59dea4b672e0c064e57be45a2febaa1c74d
SHA512 d0ef4f82d65ff3ceb2ccdc26a4b84e27cdfa84899a2d9a7b0b1d539d346e7dcc05b8f647e38f6ddd74257c0b05b8da09747553cad79b1948ef3e5a6ac6d0ec9a
SSDEEP 384:xZcIhsNx5oHD54o318BGYX5EzyOi6Q9lfi4/uANEbEeUM:ZhRDxGGYuzyO3Q9xLJCbETM
TLSH
T1CB827C72ACB4AC3B19E2A645F84A35179FB8E027F6C46F94D1DDAB1D00DE5A8130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d181854-369e-4add-8d93-b471f49e3f1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d181854-369e-4add-8d93-b471f49e3f1d.tmp
Size 8KB
SHA256 45c7cccc814867d4a365c197c5f9578c492ebf726f557e2cf850095c7681c0ae
MD5 87c6cd52dffa8f8f7a82eeb2fbcfa012
SHA1 58de509b65e363f69544160e323449e492970105
SHA512 e9f3a40c3d07ea1d7c86f383e8514463cd73769a3ed0c5556da3d2490c7eea9126da1c8743b45cfb2b6b7616fc0f3ba476c83bf25904de056977e2918f8ba199
SSDEEP 192:DONU6Dph0qQmiUyjsqswGYX59ez6CyORM6QckIIloq5vU6:DONU61PQ1swGYX5EzyOi6QdlfU6
TLSH
T17312F832B978AC7B1DE26691F48B35139EA45127FA84AF54D2DC3A1C01DF69C230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

1d4da2a3-e5a7-43e3-8baf-29af2bdcbf5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1d4da2a3-e5a7-43e3-8baf-29af2bdcbf5e.tmp
Size 10KB
SHA256 3560371b2cf33425e46b2e733fe25ee6572ced0fdb358da41cfcd722b1deab19
MD5 443c012dba0a6484fb378f8dba984201
SHA1 a7e0418feb67c3c977c796adae4ff9f37801a722
SHA512 5d21dae9313aeb7de98408912215f9c8a9f781cd85a586455e23aa20d16dd6918e3bb35431bb0f9dfa134f5516f0f11796002fb25f7db3c15691363ede0a8031
SSDEEP 192:sxZUR0WC/fXs4jIdp2fHW6+WNGYgEQbSIg57J:sxZUdC/fXs48QHbGIb
TLSH
T1F122B7566E286A7B8CC7E30DBA55BF53D6F9503261901E48AAFCC61C05E7BCD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2378ae4a-e926-48d2-b70e-18e19440bc42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2378ae4a-e926-48d2-b70e-18e19440bc42.tmp
Size 10KB
SHA256 d2722de88fe64f897ad797b3f73d4f12a922e9c0fe912a12114d14bba9ca31d5
MD5 36b615c627a013ad75b1341d59d7f9b8
SHA1 df64d8c5588b70b26197938a6aa40b529ec160ba
SHA512 66b1dcf6329daa22700b02a4f1b518aa5b98e7099099ecfbd21c63359e45b77146925ed2a1fe7c982e4e45b9cfc3b3a9fc3738f922b7257dc10775450ec923f4
SSDEEP 192:sxZUR0WC/fXs4jIdp4fHW6+WNGYg3TOSIg57J:sxZUdC/fXs48GHbG7b
TLSH
T15422A7556E286A7B8CC7E30DBB55BF53E6F9503261911E48A6FCC61C05E6BCD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e30214c-703d-4bcc-b82e-68cff13bb9d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e30214c-703d-4bcc-b82e-68cff13bb9d8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

508ce5d6-a195-44d5-b291-6e0e4e96327d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\508ce5d6-a195-44d5-b291-6e0e4e96327d.tmp
Size 9KB
SHA256 a668fcce81607f3f26c73c875ffc57d08158646912a0b08490f749ef117cb6cc
MD5 99b879e801f8f32100636a9e7b31a953
SHA1 1298ede986786283d08628e921404e2fe1fd4746
SHA512 f83d2e3797f96d72beb8a7ad680f7aac872d257be79973efdbd02f7ac4e303d49d8355847c32db1bdd29378fbe7f4a16a4213b827998d7aba412f4ff5f6e403e
SSDEEP 192:sxZUR0WC/fXsqjIdp4fHW6+WNGYgdhOSIgrJ:sxZUdC/fXsq8GHbGT9
TLSH
T11F22A7516E28B97B8CC7E30DBA65BF53D6F9503261D01E58AAFCD61C04E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81c2bca8-8ae7-40ef-897e-daa164e4614e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\81c2bca8-8ae7-40ef-897e-daa164e4614e.tmp
Size 10KB
SHA256 512fa9086120cbd6677e63f0290dbb36feb20b99401f95cfa6855fd3d48a5a19
MD5 2e1203dfd0e4fee6a409c6de41bb3e24
SHA1 2ae16d14a9a7ded097b9e387fbf5f21d47a14d89
SHA512 85a1313facd2ec99259dbeb7ab92f186cdb3065b81839f751f9b1b5481b443b82ed550082f2857ce1efb00fef8961ea815384fcd4a1a00d00562ccccb16c4185
SSDEEP 192:sxZUR0WC/fXs0jIdp4fHW6+WNGYgdhOSIg5BJ:sxZUdC/fXs08GHbGT1
TLSH
T1C522A6526E287A7B8CC7E30DBA55BF53D6F9503261901E58AAFCD61C04E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9529ba78-f7ee-4daa-8ac5-4f44fc9629c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9529ba78-f7ee-4daa-8ac5-4f44fc9629c6.tmp
Size 27KB
SHA256 4dfa061dfc0e473bc3e26cdf1e081e1c90c0e684ca8e6d93811ab64262ef96ed
MD5 c6ba8ecf1a5143abd21dbdef4b5cf732
SHA1 deb199b64cf504756da0650828f0e7e5b2c2e167
SHA512 9f1c7f1fa298b6db932cf2003b5f1db16dfa2758810d9efb5f46c710816038fc665adf85f7cff16ed2aa13a4efbebe0bb17f2a8aa556aee46537a5de07adccf7
SSDEEP 768:ERichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzzroE0s:ERichfPWvPZplu1jan+LKgzANs
TLSH
T1D4C2E97B640CCB7E4FC01A9DDD1A6F9B7EA802C7A6588D4047FA994C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4fc317f867bb19cebfb71fdce6d8e86dd8c94c07edd7af591ff5ddee801e385c
MD5 87009879d478c16892f4076af4676262
SHA1 c6eb69a280b11975a68c01008b98c4f4486c805e
SHA512 d9b5f9721fc40698fa5cc9766b6f9ea0d7df4f75d5674899554ecb917cc6ba870ed4ab00cf8f010f79ab26882c5d00e446e280e413067398f67209d0be7b1d4c
TLSH
T1F6614C815BB088B3FBA451F8C6F498D7BA32938D58839E210AE4F56D9C5732741F724B
MD5 SHA1 SHA512 TLSH

Submit Download

a8eaf0b7-9a5d-43c3-a539-4df18a042a21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a8eaf0b7-9a5d-43c3-a539-4df18a042a21.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

c11e708e-0c1c-4212-a3f6-f6b3919ea28d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c11e708e-0c1c-4212-a3f6-f6b3919ea28d.tmp
Size 949B
SHA256 a8227bbab813832d7dc31ad4b3039f60e7cf409873611554f8f7433229fc0ae6
MD5 a97761f39a13fa9a0718585c5be3d298
SHA1 f05f466bf015777c0beb8e48ea23749732594f3a
SHA512 8ddea818964162c7a08bbb57338f80193a3d8a199b0b010b8f28ce14fa9a64757e953e88b7bd525a75c772ce10875630efdf0ca620946bde31f6fdc160580d88
TLSH
T175115BB3C3D5956EC91116F05A24AE2BDE2D0606421C7D1AC9D4EF27D3E3465D10255F
MD5 SHA1 SHA512 TLSH

Submit Download

dda2fa3a-2b8a-446d-873f-b0aa2a97e91a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dda2fa3a-2b8a-446d-873f-b0aa2a97e91a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e40b67c5-9ba2-4da5-a3aa-0a9e5a959830.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e40b67c5-9ba2-4da5-a3aa-0a9e5a959830.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b2ee333f49875b38a2084930ddad373670a5ae3524ed994cd8ff8d2ef9b9bb14
MD5 45a58cb0d815d5c52383d7c9939cc22f
SHA1 f42b390a54fafac45723fb80458a427776372c65
SHA512 bd4a66698316d8c49b795f63d9fb6c29f3d5c309f9f63491c6d78da92f857d48fd57c05a97751580365cf2b999ff01cc18f4967e6103ee2537935527674e834f
SSDEEP 96:KAdOKOY6VAr8QuC+giapzIIgKQ1IWgsYIZ2KdYL3VnbrQLeaifrKaSiZrudFDA+0:URVAr8QuC+1ap8IU1IWdYIZ2Ujm
TLSH
T1B4915E0435BF069138FE79485165C66A424130BB3329F93F7FB941A34AAEE041EFE9D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff25567a-58e4-4915-9207-3e7d565a1324.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ff25567a-58e4-4915-9207-3e7d565a1324.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

3f226002-2daf-4b8c-8cff-a6827cd252d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3f226002-2daf-4b8c-8cff-a6827cd252d0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aacb89fc-26ee-4a58-bc42-de1994751007.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aacb89fc-26ee-4a58-bc42-de1994751007.tmp
Size 20KB
SHA256 0c72b67a02d547a8e567558728a7666629521f8ddd5cfc612ab160d07fbca1f0
MD5 a54c7e43d959874c30c399b5ac082eb7
SHA1 7ac49859ab0ebdcfed5eb4669f6dbaa38bba1b24
SHA512 b2f122239bdade61f34e558da3215c3832143116e2369afb1ee4cbccb8fa7902bf3dfa9c333cd01fcd44ecc2aacf3d79ea50d34a6668c2739b4d80f094625a8b
SSDEEP 384:yiFiZcILzsND8TUNTUlIl5oHD54o318BGYX5EzyOi6Q/lfi4/uANEbEeUM:5FQfmwgIDxGGYuzyO3Q/xLJCbETM
TLSH
T108A25C739CB4DD3F6DF6AB85F94A31138FB49077E590AB94E2CDAA1D009A19C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d38fd337-6542-4f17-af9b-1969f6001d41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d38fd337-6542-4f17-af9b-1969f6001d41.tmp
Size 8KB
SHA256 6c0c0daceead5c7913b565264f46128a2bc05f96cb0c8c229e5f37934d515f50
MD5 c5c51972f3288d1a4d9a0cf61fd903e1
SHA1 1f8713ba1d88fe6c25ab82f0bca9b55c6b244146
SHA512 6e439c6c2fc1101e5653eca7cef249fd551557e8ffdbcb1b2a71200269d3f174a15ecaf11ba182637a16e588bdfdbfe0d8c89d3df17adfedd0a568bf2e4c6e48
SSDEEP 192:LJONf6DphmqQmiUyXqq8wGYX59ez6CyORMWkk76yU6:lONf619VRwGYX5EzyOiw1U6
TLSH
T17602E835AD78BC7B8DE26E45F58B3713AFE4112BAA942F54D6E82A1C01D764C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df849593-2076-4d13-8ff7-b738b25c8dc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\df849593-2076-4d13-8ff7-b738b25c8dc9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5c7b41f926325d243aa9d0a1a73a0f8c7753928053000b4aca97bf2099aeb846
MD5 c97571d42180053e2eceabae763b3536
SHA1 f198102cb1dad7941186ed62f13c62804cf9f76d
SHA512 da63a0a9b0582ede0203e2eb206ff2dad625f1ee8bd7515a86e2fbc66530ce824b1cab370333ac68ed53c0deb555ce7d3dbfe0b92493d46e51e6c457dfd0f8fc
TLSH
T15C412C5CA6EA11087377BF1AABF6686D487B78773E06D49E10110D4F0627A40C861737
MD5 SHA1 SHA512 TLSH

Submit Download