c36f85fa3bfc54863069728c258c5159a60e2236575dcb41f6a3e0d9c774375f

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WC1/assets/load.html
Size 1KB
Sample260620-wtppzagt8q
SHA256 c36f85fa3bfc54863069728c258c5159a60e2236575dcb41f6a3e0d9c774375f
MD5 5576682f1a2085b2d148896b61c28033
SHA1 37b076594ec391ad92716997800daebb7b9b9bf8
SHA512 f261f046120983a451cc63c28be7c9d4c97e48586a3e43c94ca54414c169d260058fd621d1c87cc24afe3b38fda5ef61d9d1b420cfc9e1d91b2892a100608592
TLSH
T12B21F1492C835204BAABA26947FE75083167A507350DCE08B88CC3E49F85B6A912B5DD
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1160	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264528012283972"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{D7557B6C-8C26-4C0F-8391-3D62139B929B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{168B0FDA-25E6-489E-9AEC-4974D52DFFED}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 1500	5132	msedge.exe	88
PID 5132 wrote to memory of 3400	5132	msedge.exe	90
PID 5132 wrote to memory of 1160	5132	msedge.exe	91
PID 5132 wrote to memory of 3400	5132	msedge.exe	90
PID 5132 wrote to memory of 3400	5132	msedge.exe	90
PID 5132 wrote to memory of 5872	5132	msedge.exe	92
PID 5132 wrote to memory of 5872	5132	msedge.exe	92
PID 5132 wrote to memory of 2808	5132	msedge.exe	93
PID 5132 wrote to memory of 1520	5132	msedge.exe	94
PID 5132 wrote to memory of 2808	5132	msedge.exe	93
PID 5132 wrote to memory of 2808	5132	msedge.exe	93
PID 5132 wrote to memory of 1520	5132	msedge.exe	94
PID 5132 wrote to memory of 1520	5132	msedge.exe	94
PID 5132 wrote to memory of 2828	5132	msedge.exe	95
PID 5132 wrote to memory of 5752	5132	msedge.exe	96
PID 5132 wrote to memory of 2828	5132	msedge.exe	95
PID 5132 wrote to memory of 2828	5132	msedge.exe	95
PID 5132 wrote to memory of 5752	5132	msedge.exe	96
PID 5132 wrote to memory of 5752	5132	msedge.exe	96
PID 5132 wrote to memory of 1560	5132	msedge.exe	97
PID 5132 wrote to memory of 1560	5132	msedge.exe	97
PID 5132 wrote to memory of 1560	5132	msedge.exe	97
PID 5132 wrote to memory of 3448	5132	msedge.exe	98
PID 5132 wrote to memory of 4144	5132	msedge.exe	101
PID 5132 wrote to memory of 3448	5132	msedge.exe	98
PID 5132 wrote to memory of 3448	5132	msedge.exe	98
PID 5132 wrote to memory of 2708	5132	msedge.exe	104
PID 5132 wrote to memory of 2708	5132	msedge.exe	104
PID 5132 wrote to memory of 2508	5132	msedge.exe	105
PID 5132 wrote to memory of 2508	5132	msedge.exe	105
PID 5132 wrote to memory of 4856	5132	msedge.exe	106
PID 5132 wrote to memory of 4856	5132	msedge.exe	106
PID 5132 wrote to memory of 4856	5132	msedge.exe	106
PID 5132 wrote to memory of 4092	5132	msedge.exe	107
PID 5132 wrote to memory of 4512	5132	msedge.exe	108
PID 5132 wrote to memory of 4512	5132	msedge.exe	108
PID 5132 wrote to memory of 3572	5132	msedge.exe	110
PID 5132 wrote to memory of 6080	5132	msedge.exe	111
PID 5132 wrote to memory of 760	5132	msedge.exe	112
PID 5132 wrote to memory of 4628	5132	msedge.exe	113
PID 5132 wrote to memory of 4628	5132	msedge.exe	113
PID 5132 wrote to memory of 3152	5132	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\WC1\assets\load.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x27c,0x7ffba678c188,0x7ffba678c194,0x7ffba678c1a0
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,6277919287106545025,15778899902886470200,262144 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,9148695434193645716,17012477579759909621,524288 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,1204648562221831625,7858804313749725642,524288 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:13
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,6684457771336887844,5280235294673304057,2097152 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,6785575953624507320,8613112056480529328,2097152 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,4394788118548790538,900899857379336347,2097152 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,11292692373493427764,7408983720292189834,2097152 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:9
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5024,i,4626549662860680933,12892616755860609203,2097152 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5464,i,17510648303468588071,4466280868175118276,2097152 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,7996341527708981589,44466269402248237,524288 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,7996341527708981589,44466269402248237,524288 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,17417715591330769163,1110428239990888505,524288 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,942433404154304157,11279613574208419770,524288 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3884,i,17227769760930570866,633071188194044781,2097152 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,9998207367911152019,10602450690285297013,524288 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,10606193539226395516,7631479284464293774,524288 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:12
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,7373763248854832399,18320731521947357798,524288 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,8973083154295521717,2446716792269091756,524288 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,3818384020639616978,5862381774583904705,524288 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,13615949811270813306,10685435731666066648,524288 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5944,i,16058723388318092622,12703940346350959659,262144 --field-trial-handle=2152,i,13128526792183837007,12814875319450936150,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a1a244712566b46bcd9a883281f9a3f7714142d5c9c028a9eff02389a068d428
MD5 a914e4e1aff1bf9332fabaaf51998dc7
SHA1 4e75557b8c8e56b00ea1a05ae49c94bbc12c1cb5
SHA512 e0eb833498505c24bab50480ec9a45b68c59c7eec1a3207d3f3ca7e3b8491ec0e6b13d9dbbb5766ccd62266efeede421184630c1e972e030a860491c0269f236
SSDEEP 96:+NsbqJNPmkOtySC/j6gC3AxTtsGdpD9Ij6OLG8khRSYGRPkJHyfUkQ15NP967D9q:+OGd7OtySC/2gC3AxTtsGPD9Ij6OLG8Y
TLSH
T17DB1E79A62E17D51DBA00B301DEA74A6F3B0C9493E975ED278AC9076FF4A3404306C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59f41a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f41a.TMP
Size 3KB
SHA256 e91059b703ef8ae684fd1a48c4a99f55cf768ac2306a31bfd3870002db980029
MD5 1d34209efa77fd547a444ff2a7057ad4
SHA1 41a99c7e6a2eef4f9e1df356abeccfe888607f44
SHA512 20ed09d4b28dcbd6fd31605ad5c6147697396399d7323fc81d83299228a8a5bd970c24c00f26c0d4ce9e0dc6941f260744d51fd5375535fe61e4be4b6efc687e
TLSH
T109611C5F23713D62E7700D7516D9B09633B0C85A3DDB6EE0B9A0E036DF8A7459352C50
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 7849f8d884065139f157dde2e3f737ffccde57029b517975d29b80735dfbfa63
MD5 e4b91fa709609cc3aa5062441a2da30a
SHA1 27a40928e47c9dca25e91fb336b9ba054bfb1b15
SHA512 30eb9fb44b138c42403995818917f9246380d758c9acdcc910dce26a33dc7657c7f32f10b44265158a48943a4ea8f8f00e4ab47e3b3cc990880be4ceb781ef0f
SSDEEP 192:DKNXdrMcrccW/WrNvoUX61rgAQVdlswGrGqebivPaHE:DKNXdrMcrccW/WrNgUq1rTQVdlswGGqp
TLSH
T179E19AF7C3F4862CD81116F4AB547D1BCE690928472C3D6ACCD5AF9B67E2461E280A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b40e7d87b6e03533360a0756eab48e61948101b3bb51410d04cc1cf5cfc07e8f
MD5 6bf56852d1d9aa118837e961eb2c04aa
SHA1 22d35c84f48250389dca2165fb67013f0cbac41f
SHA512 666897f9b4cf3a97ca111a1b535c449799427d24a274883cf69418ebfd9060670d3e36873b42fb860c0182782d8240e504a6381447aa5dc2706782bbd25c57db
SSDEEP 192:sxRdhR1yM/jK1Ml8wF5/f/Ls8lxNkUo/GzoA8p/xCL/g6+WNIYZj0GtIgQJ:sxR7Lb5/fTs8H7Gu/5IM0
TLSH
T19462EA16A6245977CCDBD219F6917F63D6F81573F2940E44AAFCCA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 298f2d2dbf105975626bf3f6645f6e6d74553839a610db0df12ac1bf0cf29f0c
MD5 26a53b4ed66c3256e2fa1f4d78d26836
SHA1 bff8af9986387841d06557c0318013170628709f
SHA512 b6567555a8ad5709606eea9651e07e9bf90bcb107228439859ddfc9d71297c33ea0b8c45cec820b2890202053fc194a8887a039b2ce5c8b2d6289456b32d0f1a
SSDEEP 192:sxRahR1yM/jK1Ml8UQaAF5/f/LspRl3NkUR/GzoA8pVxCL/g6+WNIYZg90GtIgDH:sxRoLqa25/fTspRF7RU/5Ih/b
TLSH
T13A62D816A9285977CCDBD219F6927B53D6F81523F2940E44AAFCDA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 09f7647af7d1f8e59ca37f52825a84a609234532467fa0712d0baecc57b45111
MD5 17496fdec0936356d499e7b3ff5c283e
SHA1 8de6f68d581d8696806cfef85febbaed339eb0c7
SHA512 b9be4f22cfced80fd62630dd46d5e8731d312bb0442be065f686e67d88c6286105e02d313b6e29acf9ece2e5c24dea1bd6c8e34126001d26bef26cc301d414b8
SSDEEP 192:sxRahR1yM/jK1Ml8wF5/f/LspRlxNkUo/GzoA8p/xCL/g6+WNIYZg0GtIgDPJ:sxRoLb5/fTspRH7Gu/5IlF
TLSH
T1F162D816A924597BCCDBD219F6917F53D6FC1563F2940E44AAFCDA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 06a06d7376cf509fb6130e5faba406df5579cfb174578778370e5603ee42f1ea
MD5 f4667b87ecd4079e40b3db66056a9059
SHA1 64e3c00e352cef7b95f0ef8166f420cdb3153157
SHA512 4947b9dc59ff78076596ce3bc73870b9ee40af2ec4720371bfaf50da4eb05cc7bfb405d5e364488f818c40dd6f0c459bf1208b765833024bc380d7877a3ca601
SSDEEP 768:eOEt7IWgKgf168F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EkTqQYro7ov8nvD:eOEt7IWgKgf16u1jaZ/Qj88vD
TLSH
T133C20B2B240CC77E4F841E6DEC2A7E976DD801CB9A988D5447EE890C03C77EB521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c4b0439a0432941695c903ff0755e33d11fc276fe6a77a3b37307671f84883db
MD5 9fbff616a0bd11d0218f0a5801c094aa
SHA1 eb0027b079165de217ce4f71a70e8a7b6af317fa
SHA512 1412b145b9627ce4da3850d88438e04f8df903082113edbf2eabfe74a3712b54209bd44e0584abd3bc9f954df8f01e1f4094a480d4a0b7d2543dfe277148bacc
SSDEEP 96:KYneKwIumbSKk8ccHosCmyQWOFDk0QKcFk6QoE01achhax+6QwAyWInH:Y1xxNQ
TLSH
T1C0A1C31432B623103CFE6A059194B52F828230F63156A53B3FA871E65E67E516FFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cb5407e14750f9daaf3421bb7ebb89c56bd6235eef137506f628352e86b9e80b
MD5 7a5390476b5f9a0451a3b7bd16121531
SHA1 5788342a59810bb7c8f4762cbcb9c3e0ff6c0e9f
SHA512 e6f6fa0bcf3edc9041743bafa4a41659cf5185ff63b92b0e1a0eb527dcceefd536bdfe4199c7bc4193036cd1faf096ed787fb7b449b8683e1976fa3531784c57
SSDEEP 768:sj+97s3sHMPfcOvfvfLTV5R4HTytYYqgHvPw4KAavX:r97s3sofrfvfLWTwJRKAavX
TLSH
T14EF2AE72D9A4CC671DE2C6C4B10337577EF84323E2C52AA499DC5B0C05CBADD134791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f853b97c4134f45fa515a7a8840c6825446d8fdadc0a208edd0f72bc21ea283c
MD5 151830d5e9c9e164c75b77740efd5004
SHA1 7ca8a83dd71786ed5e09482d7e4b06af9b0e3b67
SHA512 37e21e00c17083d6c9d33a1741f259db618dfe7d28b7b9e1aafa46a95276ae860dc8afcfaffe6ad716af80ed6744265884ca3dafc4c586eaae7b766686e7b3ce
SSDEEP 768:6jaeqD4MlshiLdMma3+zMPfcOvfvfLiV5R4HTytYYqgHvPw4TTA:6qcjhIdMh3+sfrfvfIWTwJR4
TLSH
T15803BF76ECB89C674CB2C585B20337A76FB44267D3C92AA4D9DC1A0D05DB6DE130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 52ca243bd17bd389f273c161b3f7e8098cc2e7f7d85e8cb3d1f4099529e80a45
MD5 e2428829c572063c5e363963bdcb5578
SHA1 a376f002e91306592ff12fca49cf1d212c694460
SHA512 aea12ea6f56e6cdda2aae59f37e2d09ec8b71f2d6051ccff0774049ecf31a1d92ca36fc571ff989fe3b00c38166551c707701793e0f2bb9a156384ab1538f6f1
SSDEEP 768:OjaeqD4MlshiLdMmes3vzMPfcOvfvfLiV5R4HTytYYqgHvPw4TTA:OqcjhIdMjs3vsfrfvfIWTwJR4
TLSH
T14903BE76ECB89CA74CB2C585B20336A76FF44267D3C92AA4D9DC1A0D05DB6DE130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 77b35de1f7a7b5e65946cbdf88edbc5f503f7c7eeec48e4d199ad4e60977c37f
MD5 981c833c4b1c870f87c8bc2a3fc647fa
SHA1 31d4b6a51b05a399b9db7cdb0831052a9226f0c0
SHA512 ffb7cda5057f543a3699baea4f4d8954849bd2c68bfa1eba6d9cf189419a23159ef6097333349578592159853b5453d2e7a2c522ce9317361b13a6b6593c02c9
SSDEEP 768:ij+9Es3DHMPfcOvfvfLiV5R4HTytYYqgHvPw4KAavX:R9Es3DofrfvfIWTwJRKAavX
TLSH
T1BBF29E72DDA48C671DE2C6C4B5032B977EF84323E2C52AA49ADC5B0D05CBADD134791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b4c95b69d7b89efbee0461d17518b63913b6c7f8b34031aa66f49a879ae7588e
MD5 c4ab0417a968b23e1d9d87edb475b941
SHA1 af2f9ae81689083a14e2e908e50f450befa6e2fe
SHA512 7bc89e98dfe3726d5e190d3b642794a31424442805aab28f1bc6662cd1bf278cd20c03af018c99c4b33255f2b9c7402ed6af3bdc9d3b2f29546bba88a1e8921a
SSDEEP 768:EjaeqD4MlshiLdMma32DPfcOvfMV5R4HTytYYqgHvPgUyjWtxjTo:EqcjhIdMh3mfrfyWTwJNyj2y
TLSH
T1B003CF76ECB858B78CB2D685760277A77EB442A3C3C52A64D9DC5A0D019BACF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 31086c185d0853732511b28d3b99f0e105a18a5cbfa9001f6df2d0eedc9d4187
MD5 55ae743844207f9eaaadb0c48fc07ec5
SHA1 95334a6d8c07099b6adc7c6be21817f3e9a66cb1
SHA512 fa6768e74fb0c08c1d08384b3af91de5c13d875f43048c0263955fbe7a9fcf55a5c041cbbc157d08fd946c202fd7f86db73d9216e557a96a05cb15015c88b8cb
SSDEEP 768:6j+9Es3sHMPfcOvfvfLiV5R4HTytYYqgHvPw4KAavX:59Es3sofrfvfIWTwJRKAavX
TLSH
T18AF29E72DDA48C671DE2C6C4B5033B977EF84323E2C52AA49ADC5B0D05CBADD134791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download