34d475f12fb2d088b32aa0763ece41589e702c787305a3ac5086d029292697cb

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
L2/assets/load.html
Size 1KB
Sample260620-wtppzagt8p
SHA256 34d475f12fb2d088b32aa0763ece41589e702c787305a3ac5086d029292697cb
MD5 17b177ab773d7be1d80dacc775b629a6
SHA1 9c51672fc28bfc7e9ce3c5e148f2642655527a10
SHA512 6da82b0d5401425ac9ca7e74752e3e79af5abca8c07ed3a81225f7a5dd03ae369ff88c19201d1d01ea617c451083a04842fb9eef7cea586316981690ff7f2bac
TLSH
T19321F1496C835204BAAB626947FE75083167A507350DCE08B88DC3E49F85B6A912B5DD
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5092	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264528022835957"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3655380807-1096177077-1670381078-1000\{8279A9EE-79ED-4183-8986-11703208A42B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3655380807-1096177077-1670381078-1000\{284C50F1-258A-4D79-9AF7-C56F57277B7C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5204	msedge.exe
5204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 5412	3712	msedge.exe	88
PID 3712 wrote to memory of 5996	3712	msedge.exe	89
PID 3712 wrote to memory of 5092	3712	msedge.exe	91
PID 3712 wrote to memory of 5996	3712	msedge.exe	89
PID 3712 wrote to memory of 5996	3712	msedge.exe	89
PID 3712 wrote to memory of 3124	3712	msedge.exe	92
PID 3712 wrote to memory of 5420	3712	msedge.exe	93
PID 3712 wrote to memory of 1920	3712	msedge.exe	94
PID 3712 wrote to memory of 3124	3712	msedge.exe	92
PID 3712 wrote to memory of 3124	3712	msedge.exe	92
PID 3712 wrote to memory of 5420	3712	msedge.exe	93
PID 3712 wrote to memory of 5420	3712	msedge.exe	93
PID 3712 wrote to memory of 1920	3712	msedge.exe	94
PID 3712 wrote to memory of 4224	3712	msedge.exe	95
PID 3712 wrote to memory of 3912	3712	msedge.exe	96
PID 3712 wrote to memory of 4224	3712	msedge.exe	95
PID 3712 wrote to memory of 4224	3712	msedge.exe	95
PID 3712 wrote to memory of 3912	3712	msedge.exe	96
PID 3712 wrote to memory of 3912	3712	msedge.exe	96
PID 3712 wrote to memory of 1568	3712	msedge.exe	97
PID 3712 wrote to memory of 1568	3712	msedge.exe	97
PID 3712 wrote to memory of 1568	3712	msedge.exe	97
PID 3712 wrote to memory of 2556	3712	msedge.exe	99
PID 3712 wrote to memory of 2556	3712	msedge.exe	99
PID 3712 wrote to memory of 2556	3712	msedge.exe	99
PID 3712 wrote to memory of 572	3712	msedge.exe	101
PID 3712 wrote to memory of 4992	3712	msedge.exe	104
PID 3712 wrote to memory of 4500	3712	msedge.exe	105
PID 3712 wrote to memory of 4992	3712	msedge.exe	104
PID 3712 wrote to memory of 4720	3712	msedge.exe	106
PID 3712 wrote to memory of 4720	3712	msedge.exe	106
PID 3712 wrote to memory of 6088	3712	msedge.exe	107
PID 3712 wrote to memory of 6088	3712	msedge.exe	107
PID 3712 wrote to memory of 3840	3712	msedge.exe	108
PID 3712 wrote to memory of 3840	3712	msedge.exe	108
PID 3712 wrote to memory of 3840	3712	msedge.exe	108
PID 3712 wrote to memory of 3316	3712	msedge.exe	110
PID 3712 wrote to memory of 3888	3712	msedge.exe	111
PID 3712 wrote to memory of 1624	3712	msedge.exe	112
PID 3712 wrote to memory of 5788	3712	msedge.exe	113
PID 3712 wrote to memory of 5788	3712	msedge.exe	113
PID 3712 wrote to memory of 5204	3712	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\L2\assets\load.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd4053c188,0x7ffd4053c194,0x7ffd4053c1a0
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,1525166286851173272,6084773090298232871,262144 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,7755080675497400986,9794137951514442686,524288 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3316,i,1630230981692837009,5351118501039629901,2097152 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3332,i,17920871846605983067,12898237030682637202,2097152 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,1816131695921739414,9566515031309817649,524288 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:13
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,7706974513165141308,6117855755597069868,2097152 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,8164175128075348496,16732594938642361858,2097152 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:9
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5248,i,10147705690362606571,5424812548396151582,2097152 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4892,i,6603625091802649713,1078919951195889412,2097152 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,17458727777110648966,151265921827179773,524288 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,17458727777110648966,151265921827179773,524288 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,3419026868662956907,6218895463275667231,524288 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,15175428908246674642,5378234659820696040,524288 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,13883663076982596178,12143160896904490400,524288 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:12
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,16551055390150456052,16377318649338220569,524288 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4392,i,10496682719571724312,15574352365742813742,2097152 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,4453412315493778647,81819653618062742,524288 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,3252840953961396707,10774488374776772553,524288 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,8638796285090326080,10607681280959442437,524288 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,15404366693239830984,7255647118345188301,524288 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:14
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6684,i,2637762676928438977,15840823900726619729,262144 --field-trial-handle=2240,i,7606302550107077895,6361218519331046220,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a73b32029b5d0c6ff7ae727c0f35079c0207fb5160bb2094317e96e23daf1cee
MD5 5fd2ab1b84f4c46ecb80443cacd9d150
SHA1 dd5f53ee71d94f4de7f9196f7dd42d06437a3320
SHA512 80afd342835e5b7c47013c2e8821b8636a9782f5c0541da2d81ad7da7f1be3e061af3ccb4f9143b3b85ff16c6113c3f6bf41ea64da18da643b2cf34c67ef65d1
TLSH
T1C2D0C0303300F601C0CA24B4FC106311123B8A1230E3C21D7020D00DEE940D0EB8B45B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02e83107bdf4cefad04d7dffca4065fb67146265abf734fc1a0a6c97297b321d
MD5 e502aaa276aa06e6296f6ef4749253aa
SHA1 99b55990cdf0fa9357771717d8ade2d2ba1023a1
SHA512 2f9d794c6e91e4888f5f7323dc7b92a27fbabf3cf561300c11be8833a6a0a6f5855daaa7cfc1901faab9b2932d40d1361bee35e50c2951c0e558a06150e71a6f
TLSH
T131D080707755F505D5CA25B9FD146315523B8A5220E3C61D7160D00DEE940D5EB8B457
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 953eebc8a58048613ff57b0e9bf6bf5a5fbe407894fe295c8ab88968336f3bcc
MD5 5b06cb44746e17fd565f67da9eb41d49
SHA1 4f771c53c8ebfa091f4233ac2cb2e1a723515f3f
SHA512 09616a5a5e16c7202b6a40e2971d79782d0546adcaf008d43d14d1ef0b72e8582134f1f7c2605f6d0bd1f0d790baafef76f2706bb2782dc3755ef430bfaeb77d
TLSH
T10481D84589F55516EB1E073368E9E8EAFBF8C5947E0B5F1A40BF507339DB390104228E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 138e9b51024d3b8f9ca2ac571387233ff29bca56c7048401072a4d48caec8565
MD5 fd4c1d1999e91c5cbd578dec5f57c53e
SHA1 35d52e525a72e477e4eacbd63bfb4b8b57777e58
SHA512 a906dc4f18a049c30e30e73c8ec25839045697e72f266d54b06c893f1658d515a01802e7522acd17f2475c8973cdb8f84f9187ce2fd19426ee5bb2ab827bbae8
TLSH
T10D81C74589F54426EB5D0B3368E9E8DAFBF8C5947D0B9F1A40BF90733ADB780504228E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 1b89a463d3af72f84d63f7e8c4d00c58f328eb35793c88e2633fe821c6a3d1e3
MD5 983268e3d0c0ce8d8890fb83d4c0a45a
SHA1 a81a1932c01868e84f0ef0a80d243783040463ce
SHA512 ff55f802634dd83097a1c1e4ade88a1915f65acb5288c9cb5774d1ee885c5f2bac39a5bbdd4cc78dec761edf953ab1b43dd6913190abd6eb3ec08d0adc81722e
SSDEEP 192:DZ50CIJx46tM8+1/l8vAUX9EbWg3dc33QVSD/0neyJ5B4RNoNwZjZX:DZ50CIJx46tM8+1/l84UtEbWydm3QVSX
TLSH
T11DF1ACE3C3F4862DE91116F46B547D1BCE6C0924472C392ACDD5AF8BA7E2471E280A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9a20cb60fb0ce3fd32b8029ca26d65943880cacf7a2d780ecbd1dec08cefd34d
MD5 003a365341a19244d09f5161ccd30a7a
SHA1 3d15e30dc909eba4493e833d73e07065ee911f69
SHA512 c2b6fe844d3b97635b46543f655b652ed7b2fed3002d24612d2183dc10bea8f11419af5208e3959ef107055e42a18b395a7e80bf16126972ec2ddaab8ac762b1
SSDEEP 192:sxRFRDFB/fWs6W7G2spb5zoA8p/y+6/g6+WNIY5oBbL8G8IgDLJ:sxRF/B/fWs6WaTbEU/5INBoJ
TLSH
T1B742B856AD28697B8CCBE21DBB967F13D2F91032B1D45E48F6FC961C01E6ADD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a481127be3e0276ffd9bd270d24b0d8bdf1eb082d4cccc121cc25c5b3c1180db
MD5 85befc5cff1e2a79fce7ef364d1aa7d1
SHA1 5f0044b9ec07efb68c4896ba79d9d84e800b84df
SHA512 9c49adee3bb49b9157cbf7726bd569851addfa198eeec09702c1edd934ae672b9cc345d20779c91f7893b535f72999ab7ca238f52613425d972809318df1ac68
SSDEEP 192:sxRFRDFB/fWs6W4G2spb5zoA8p/y+6/g6+WNIY5xL8G8IgDhJ:sxRF/B/fWs6WbTbEU/5I2oH
TLSH
T1CB42A756AD28697B8CCBE21DBB967F53D2F91032B1D45E48F6FC961C00E6ADD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 fbc4fbf2c8eaa82b91d1acd22d258863e091e03acd26a35bd957d138fcb0cd32
MD5 f79fc6102240baaa9a64c64bde72c26e
SHA1 47156812a34fb0bddc5d112ad30b449d19748dd2
SHA512 9a3882a252a3c8529dea250d54ee59c0979f576e8b2003790978caa2f68f4d4e7973b29bb82ad6e6d39461f977caf20e96e5b47178b24d382e01db891c2452dc
SSDEEP 384:QWE2hvofCtgmUFfewKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVEA9oMRd3rogHi:QJ2hvCWgmcfew8F1+UoAYDCx9Tuqh0VJ
TLSH
T16BB2EC2F604CC77E5F800AADAC196F976DA801CB96588D4047FE990C03D77EB522A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

fbe04a90-7a13-49df-8f1b-c2609e0c53af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fbe04a90-7a13-49df-8f1b-c2609e0c53af.tmp
Size 12KB
SHA256 87c137fb70b8eee80cae7f7c69546cf5cf71b6c5f85871b33dbaf6afaaa49cb3
MD5 e24ed3b36499de7f067847eeb0505263
SHA1 f7640fc0aaabce4ab30dfa249312636bb6a6a2a2
SHA512 57a02c6521401484b4c53ed23ca58030a7f18f433983f8b07db422e19dee811a982a92f0e0e7626f53cdf1a7e6b1fbd63a7c9a8654acb9fae420ece7288b256c
SSDEEP 192:sxRmRDFB/fWsP4G2spb5zoA8p/y+6/g6+WNIY5xL8G8IgIJ:sxRm/B/fWsPbTbEU/5I2os
TLSH
T14E4297566D28697B8CCBE21DBB967F53D2F91032B1D45E48FAFC961C00E6ADD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59dc2d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59dc2d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 87af1d90869c636aeeb4670b41abf4b350f81658631bbd4e7f1dbd90fe67d0ac
MD5 492c8bf2cacfc829aaa4312395746b0d
SHA1 8d37289d6e6d1acb9ed7c7be49b8e303588ad445
SHA512 475f2d0f52fe8e78967bdc12cfa2510bd2f262c4e917202c60cec984777ab0d3e8266bb4e129df3b0083435344cab16d909db271b5c45040131ba26e550a738f
SSDEEP 768:Jj+923rl290rjf2fAtcfG4XZ0SEbuRpag62Dai+fAhn/+0tvK:U923rl3f2f1fxuijag6E+Ih/hvK
TLSH
T181F2BF729C389D738DE793D9B50A3A8A7EB40643D1D52B889DCC1A4E05DB6FD1303A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e16d81e4d8e33560fd22f8fea3f8191dacca66ec838885a218a9a1f85004ae82
MD5 21957149238d8f6f265c61eeed4cfbf6
SHA1 fd42a1d9d9d9ea548fbc293e14284c36f060e338
SHA512 24d594fe3aff5c9098abcbef2c519c0ccae63adb2b05ba4ec59f3c78593585298c085e6daedb9957910e617c99a3fa4273918430c5ecc26c41f32addfac01cec
SSDEEP 768:ujaeqD4MlshiLdMmE3rl+90rjf2fAtcfG4IZ0SEbuRpag62Dai+fAhn4YTM:uqcjhIdMH3rl/f2f1fxPijag6E+Ih4z
TLSH
T12903BF75DC789C778CB7A285B5473A976EB00243C6D93B88ADCD160E06EB6ED1203917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2c4718141f5236d290d7960230a5c86fdc34e5e0c2a3a3407a2d3014e0ed808d
MD5 db1fd36fd526219fec5ea4cc54235326
SHA1 a99847fcffe34d05cd32be531017eca26836f1ef
SHA512 bee2a968b300b745dab5e485e6249867b1142aafc261111f5d7bd5d07e3cc66bd010db71b23c70daa255892c5214ab2995249b5cd54fe57c166f7e9f90f52bc1
SSDEEP 768:Vj+923kl290rjf2fAtcfG4XZ0SEbuRpag62Dai+fAhn/+0tvK:g923kl3f2f1fxuijag6E+Ih/hvK
TLSH
T19AF2BF729C389D738DE793D5B50A3A8A7EB40643D1D52B8899CC1B0E05DB6FD1307A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 4f713096303b389d20e440d0d03169e13218a5cb393a30c94f27d985baae7e41
MD5 07961a5e1387a8e9b07524e202b46a45
SHA1 83a8b7e811b12c97408bcb4127d4c0f7175cf52a
SHA512 7bd7ff22845248ed905804fbd578bc47589d561d2179a35f49661bc2067bf0ac010859ef9b6f1e29f54a74cef0b3e1fca557659ff0da98d41b50cf00fcad9f87
SSDEEP 768:OF1j+9V3JwgWlO90rjf2fAtcfG4bZ0SEbuRpag62Dai+fAhn/+0tvK:r9V3elvf2f1fxSijag6E+Ih/hvK
TLSH
T11E135BF288E78976CDAE9787A73D2D466DBCC243B09166847BCC090DCD971BFC206906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c3a605b31d59f9edf3b5c4e15e97d20647777d67c2f06e133f9d5320441cf51f
MD5 eb13c93fed4df72a5f8bf553fef0bcf8
SHA1 dea1e1d33b785d6a2c42d4cadbc9c9ad43f4bb73
SHA512 8da46eb14d8461a56ef228cbbbaae1774b367610f094085e33ddbc501314a43b6be9ec3f00c1268c04617bcdda5f7ee917e9ada53d92607c04682c93058283af
SSDEEP 768:GjaeqD4MlshiLdMmi38s0rjf2fAt5Z0SEbuRpag62Dai+fAdryjWtUkTu:GqcjhIdMl3sf2fpijag6E+IJyj2U
TLSH
T1CB03C0769C744C778CF7A285BA173A976E740683C6D67F8899CC260E12EB6DE1203817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90db5156-5c37-461c-88f4-647b55eb25b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\90db5156-5c37-461c-88f4-647b55eb25b3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download