a49987d948d18c7c6d3a51a302c4d252970f33279b79ee817b12fab7b06f5e02

Analysis

user interaction
yes
max time kernel
47s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 67KB
Sample260423-hern5ahz2l
SHA256 a49987d948d18c7c6d3a51a302c4d252970f33279b79ee817b12fab7b06f5e02
MD5 45a1d5b801dba18fdee87ed2a5993a18
SHA1 9db006b94ed7727b14b2239f46b548e27f4241f7
SHA512 414b9a6d0dcf7bc9afc11a6de49f2126d701614120f3181fd437a0be6ea317778e0c5435866ddda9d726cf54e907be2e92a87c2119d9236c493b163c269ebb92
SSDEEP 1536:rI1ulWIAPI2Qdg07ZMXjek+w1tgvftsjfUzAux/q:Q0fw1ZQnq
TLSH
T11463C62B66C01425643793F6E7A36369FBB54003C907822C7AEE13964FF2D58C663F98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4364_853466996\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4364_1970139846\_locales\id\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4464	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214000068590248"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{89609D0A-8F25-4E6D-9546-2BAF70584FF4}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4508	4364	msedge.exe	83
PID 4364 wrote to memory of 4464	4364	msedge.exe	84
PID 4364 wrote to memory of 4560	4364	msedge.exe	85
PID 4364 wrote to memory of 4560	4364	msedge.exe	85
PID 4364 wrote to memory of 4560	4364	msedge.exe	85
PID 4364 wrote to memory of 4484	4364	msedge.exe	86
PID 4364 wrote to memory of 4484	4364	msedge.exe	86
PID 4364 wrote to memory of 560	4364	msedge.exe	88
PID 4364 wrote to memory of 4432	4364	msedge.exe	89
PID 4364 wrote to memory of 560	4364	msedge.exe	88
PID 4364 wrote to memory of 560	4364	msedge.exe	88
PID 4364 wrote to memory of 4432	4364	msedge.exe	89
PID 4364 wrote to memory of 4432	4364	msedge.exe	89
PID 4364 wrote to memory of 5980	4364	msedge.exe	93
PID 4364 wrote to memory of 5980	4364	msedge.exe	93
PID 4364 wrote to memory of 1076	4364	msedge.exe	94
PID 4364 wrote to memory of 1076	4364	msedge.exe	94
PID 4364 wrote to memory of 1132	4364	msedge.exe	96
PID 4364 wrote to memory of 2832	4364	msedge.exe	107
PID 4364 wrote to memory of 1416	4364	msedge.exe	108
PID 4364 wrote to memory of 2232	4364	msedge.exe	109
PID 4364 wrote to memory of 3660	4364	msedge.exe	110
PID 4364 wrote to memory of 3660	4364	msedge.exe	110
PID 4364 wrote to memory of 2604	4364	msedge.exe	111
PID 4364 wrote to memory of 2604	4364	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff99ed1c188,0x7ff99ed1c194,0x7ff99ed1c1a0
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,7475443638374912935,2311781832834802653,524288 --field-trial-handle=2272,i,14857717469943497704,12463511578073286326,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,16556935327174192607,11705381193931100672,262144 --field-trial-handle=2272,i,14857717469943497704,12463511578073286326,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,13920631002941635302,8976037549743115473,524288 --field-trial-handle=2272,i,14857717469943497704,12463511578073286326,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,6687601686232925650,3139831746270105946,2097152 --field-trial-handle=2272,i,14857717469943497704,12463511578073286326,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,17821065440154748873,1267140512026994658,2097152 --field-trial-handle=2272,i,14857717469943497704,12463511578073286326,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,5375712486268008605,13815192239430411367,524288 --field-trial-handle=2272,i,14857717469943497704,12463511578073286326,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,14413992577089901538,7678777624478336393,524288 --field-trial-handle=2272,i,14857717469943497704,12463511578073286326,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,14816262340758915285,10480156907687695185,524288 --field-trial-handle=2272,i,14857717469943497704,12463511578073286326,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,14816262340758915285,10480156907687695185,524288 --field-trial-handle=2272,i,14857717469943497704,12463511578073286326,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,1011166196203555110,12275833689977931198,524288 --field-trial-handle=2272,i,14857717469943497704,12463511578073286326,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,9362282588821433551,2466319586303769757,524288 --field-trial-handle=2272,i,14857717469943497704,12463511578073286326,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,16804000604785640301,11957582321771357648,524288 --field-trial-handle=2272,i,14857717469943497704,12463511578073286326,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,8755586562940678231,3312868311605966543,524288 --field-trial-handle=2272,i,14857717469943497704,12463511578073286326,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,17584747101224369684,753553198525716816,524288 --field-trial-handle=2272,i,14857717469943497704,12463511578073286326,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8190c3e93fb6649754fbecb05bf3e4a4a4421894afa4937c3d2da190a0627670
MD5 56c5aada5181a0a8219f416bb0f9c172
SHA1 25c3780116efd4208ede8bfdb29ae4676e043f2a
SHA512 244e2bfeef1a11828fb0577be108aec3bde9447da52e769950be434084a8f44c8259f9e70248f549d1e3118a4393d3b72a2c01e05822f404c2f2e2470b5a5347
TLSH
T12DE02BA5C862EC2708FD171961500682E75423472BC1488B7A3C9308CFB1A37458685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f93d262a00eb35b529cbdc6d8550ae48904ca4cd7e35794e251274a1a2c31e32
MD5 6e74b07647abd5ba4ddae4d15a8ba63c
SHA1 bd4e2784cb66e7764db0b2e27dfc4d16e32b0cb1
SHA512 dc2dd1b6124882e1b23d59f978579134c6a7f63162fe97bcee61b9321e980b41297e1b5916819a44ffd71b70b904bd7a0b4bd7944ad8570eb79e7a1bdb05ac9b
SSDEEP 192:sxZuRqyMqZ/K1Ml8MkI/fjskfskvqrjpHzodpH6HW6+WNGYKmC3m1pgIgjyJ:sxZuTMI/fjskfsaimaHbGjmAjO
TLSH
T1D662E8156A38997BCCCAD209FA457F93D7F91563D1804E48A9FCCA0C05E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 caf17bf0e1b0e5e4e173778322e8e5c4e7f9c0d78561c46880d75833e4386882
MD5 1fa0b8fbcd29dda6f5e542a50c0c7737
SHA1 e821678fa64b55b8b1792ac96a9c52ec3a8280f2
SHA512 b6cd24a8a0fe7936ded51b9c111d3e7035768b79f319a2e555639dab2c01608cd113df259eeeb676f9f633e9de905f7a48250cc94054bc9218a9791cbad6186e
SSDEEP 768:DXgLiAo7pLuL/aeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgMKJLlhzCpUroG:DXgLiAUE/aeWvaShqu1jahMKJLDOp/G
TLSH
T132F20C3B2C0CCB7E4F844E9CED2ABE8E6DE402CB9698895447FA444C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0603482042204c7ee10c3e7de9e697a4c74ef2b0115b920e974b20cd9fcad2e0
MD5 536ba2c8c8d9d13f678db2cb04f6379d
SHA1 a408f63b91a32eeac3cfcf358f0ba8fbf0fd772a
SHA512 22084cf56a75454a46ce6fc1c8e2fd12d903789de0fa28023786b73e5cf075a8254810d62b401345dcc81b9926fe38db14efd97c278e6fc79566ee5206919de6
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BnR3l:krN/INhx+kcxKBzxnRl
TLSH
T1B0B23C11727A12813A7E399AC595B41F36C230633098B93B7BB914A60F6BE20DDFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 57d678bf90e19cf296ed82822ae90d86b6ee4ba3546f8396e1ccbdc391c19337
MD5 959bf5750015b4ab34baa68f9befc5da
SHA1 bbbf948db6523b32c2ef793cecccd5cd90197309
SHA512 f2fbe51854121f7de5be6af3dbadf09dbb2cbfddf33ec2733f721e9e5966fa3f9da3c77998520ee5c76bd279a8d9463fe089abec9e08923cf3848fc8c64bfcc2
SSDEEP 384:nuiFavqMg3sNt8TUNTUlIm2ZTPENP6OwfjYplDJsPByRYV/Vw1mRgCe0QrN1k+5X:FFayv3kwgHIuYplJK8RYk1m2/00P
TLSH
T199C24A35E8A8DEABEDE69FD5AB093A07EEE00267D58C4AD4DAD80D1D00971DE1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1287282644eb4fbd1abd534831b439153f3c06992664fe59c67a3854991149ce
MD5 408933a18ce3258c62a7a45ba4c0eae6
SHA1 dc7a236382abe1ca8740a43d642b48ef46cd33cb
SHA512 d6d4ed62b34ecf49399d7ec8a097be50d6881f2b20ead4760454208f5eedf277ab79bbd56311c1f63404d1ddae1a6638fae2fd95db8a1fe68f2a6bf1c3c91b75
SSDEEP 384:n2iFJjccCs+Bt0S3c3sNa8TUNTUlI45BZTPXVpOwfjYplDJsjKllnbc1efrN1k+0:dFJccQ83DwgaJDYplJdllno1AIz
TLSH
T16AC26C36E8A4DDABECE78FD5B70A7B03AEE0116386C85AD4D9C84E1C00871DE130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9f76f9e1a98e8387074d7f206b6e40d59e92810c0a272fff433f196f4e3b7bd3
MD5 2b49a3a6605bfd9013478c9b5690790d
SHA1 e19b08f22f8d40f6e5e01fa3020c3b3ce4b85df2
SHA512 bd76ba474dd247781b528d8c372a8bf0c416ae131e7d80c0c5c02a3b8b7ad366f20246a87f45c8136c4ea665dc94bed77da323c0639d1417a9300e641817152f
SSDEEP 384:njiFavqMg3sNu8TUNTUlIm2ZTPNH6OwfjYplDJsjqlRYV/Vw1mRgCe0QrN1k+5v/:OFayv3TwgH1uYplJvlRYk1m2/00P
TLSH
T133C25B75E8A4DEABEDE79FD5A70A7A03DEE01267C58C4AD4DAC80D1D00871DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 302632375941bb37774bb72e658ba833a4e862b92c565eac376076fdbd2f04ba
MD5 f0e382560b15a63a8e63a37170be389e
SHA1 277d5510def00ce745e9080ce8991df5956b3495
SHA512 66ec9c1bf52662902cffe7a4d3c121cf2935b4c222a03a002e158cd413e2b148ddf272cde573d6a2b1d4c1c11325ea89ec2af0c7a96b13b888edff5e586fc2c2
SSDEEP 384:njiFJjccCs+Bt0S3c3sNa8TUNTUlI45BZTPPVpOwfjYplDJsjKllnbc1efrN1k+0:OFJccQ83DwgahDYplJdllno1AIz
TLSH
T1E0C26B76E8A4DDABECE78FD5B70A3B03AEE0116796C85AD4D9C84E1C00871DE170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1842dcbd96e70a88f2578c18d9d6032df091511997c2cf74ec4f84e86a906c13
MD5 03a2e0b8795909ffb3d1b328fdf2f7ad
SHA1 4aee4863d1650330fdcdae6cc971b67cfb419477
SHA512 763e267e04983310fc7b87c07cce87427606d2d37164124a8dc1d58d8d407d5d745b91edd9fe70501c3f2687b9a63b09ba977b2566f8ecf49ba00053fa100267
TLSH
T1D1412658B6EE1109B3B36E1AABF6686E487B79772E06D45D00210E4F0632A01CCB1B33
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads