e11812eef5ce7f4a656fb65d0f14eb2be49bb5963a96a788bdfa47ba4f2348d1

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260626-aptbpsgz6r
SHA256 e11812eef5ce7f4a656fb65d0f14eb2be49bb5963a96a788bdfa47ba4f2348d1
MD5 6487609497df1058e0993b39f6b82cd8
SHA1 c05a11e30744e27afa872012bc1e60dd8c341e0b
SHA512 c4ea678cd1c0f668705fda35e70836b72641484c827fa95e14037d00e7043b603eea87411b4324a3bf75323b74ba844ff156aba8cde2bfe2f670575d5a956fc4
TLSH
T18151AB75FFC0119273924F6329EA35D4F54AAD2F75804429631FB7A1650B93B8CE1A70
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5240	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269070284326548"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{1627E3BB-9065-4366-A8BA-1DBCD68F1568}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 1548	4124	msedge.exe	89
PID 4124 wrote to memory of 5240	4124	msedge.exe	90
PID 4124 wrote to memory of 5020	4124	msedge.exe	92
PID 4124 wrote to memory of 5020	4124	msedge.exe	92
PID 4124 wrote to memory of 5360	4124	msedge.exe	91
PID 4124 wrote to memory of 5360	4124	msedge.exe	91
PID 4124 wrote to memory of 5360	4124	msedge.exe	91
PID 4124 wrote to memory of 3040	4124	msedge.exe	94
PID 4124 wrote to memory of 3040	4124	msedge.exe	94
PID 4124 wrote to memory of 3040	4124	msedge.exe	94
PID 4124 wrote to memory of 4948	4124	msedge.exe	95
PID 4124 wrote to memory of 4948	4124	msedge.exe	95
PID 4124 wrote to memory of 4948	4124	msedge.exe	95
PID 4124 wrote to memory of 3452	4124	msedge.exe	96
PID 4124 wrote to memory of 2996	4124	msedge.exe	97
PID 4124 wrote to memory of 3452	4124	msedge.exe	96
PID 4124 wrote to memory of 3452	4124	msedge.exe	96
PID 4124 wrote to memory of 2996	4124	msedge.exe	97
PID 4124 wrote to memory of 2996	4124	msedge.exe	97
PID 4124 wrote to memory of 5316	4124	msedge.exe	98
PID 4124 wrote to memory of 5316	4124	msedge.exe	98
PID 4124 wrote to memory of 5316	4124	msedge.exe	98
PID 4124 wrote to memory of 3944	4124	msedge.exe	100
PID 4124 wrote to memory of 3944	4124	msedge.exe	100
PID 4124 wrote to memory of 3944	4124	msedge.exe	100
PID 4124 wrote to memory of 1544	4124	msedge.exe	101
PID 4124 wrote to memory of 2044	4124	msedge.exe	102
PID 4124 wrote to memory of 1544	4124	msedge.exe	101
PID 4124 wrote to memory of 1544	4124	msedge.exe	101
PID 4124 wrote to memory of 4764	4124	msedge.exe	103
PID 4124 wrote to memory of 2044	4124	msedge.exe	102
PID 4124 wrote to memory of 4764	4124	msedge.exe	103
PID 4124 wrote to memory of 3132	4124	msedge.exe	105
PID 4124 wrote to memory of 2932	4124	msedge.exe	108
PID 4124 wrote to memory of 2932	4124	msedge.exe	108
PID 4124 wrote to memory of 2932	4124	msedge.exe	108
PID 4124 wrote to memory of 4820	4124	msedge.exe	110
PID 4124 wrote to memory of 3128	4124	msedge.exe	111
PID 4124 wrote to memory of 2656	4124	msedge.exe	112
PID 4124 wrote to memory of 5228	4124	msedge.exe	113
PID 4124 wrote to memory of 5228	4124	msedge.exe	113
PID 4124 wrote to memory of 5228	4124	msedge.exe	113
PID 4124 wrote to memory of 5016	4124	msedge.exe	114
PID 4124 wrote to memory of 5016	4124	msedge.exe	114
PID 4124 wrote to memory of 1492	4124	msedge.exe	116
PID 4124 wrote to memory of 1492	4124	msedge.exe	116
PID 4124 wrote to memory of 1492	4124	msedge.exe	116
PID 4124 wrote to memory of 3800	4124	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffcc023c188,0x7ffcc023c194,0x7ffcc023c1a0
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,13545296878377910612,10809168493979086543,524288 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,11618384072084884730,3057652167950488206,262144 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,13271679174196061587,6108295004616962096,524288 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:13
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,17307260069538887472,5993384875347041113,2097152 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,8384478558628822953,2796024492372424638,2097152 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,17857809996221287652,1514926685920093120,2097152 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,12929960383675233104,12746609073670237931,2097152 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:9
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5232,i,2828315048962202297,15769634902616537688,2097152 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4320,i,2853654958503139004,16817176123478386423,2097152 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4920,i,10920527259314229561,13220027669021867152,2097152 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,10386414462239973596,1589954526524266950,524288 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,6128605287830952549,16363788694145245476,524288 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,13240519968776916132,17748225826044321347,524288 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,13240519968776916132,17748225826044321347,524288 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6632,i,2452094595236806904,8289303711438815234,2097152 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,14751488687826624689,13305267644931747211,524288 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,10669110959278405203,14523660765801418265,524288 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,3579208076562737348,2773144000099405147,524288 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4960,i,11152688768763692290,12281417817782402538,2097152 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,4716775043117667597,1644314216137549727,524288 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3704,i,7780478208558105266,958708697304073292,2097152 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5096,i,4580845811150809253,14523601528943420877,262144 --field-trial-handle=2332,i,6251958610557875562,7181882963474798003,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4921dac989a582c68ea2ce6e44eb3bfcd7f8bf3d87dd155763734d09e46d6684
MD5 6fe58dba083868c4939df3729856b544
SHA1 2946fc6a531247a5afe5d20c0abec1329e76da1f
SHA512 435b892e3c3ced9c341bcad7627e98220f381783f6c0d232345dd92e9cb28357bd93211262aa046fe541f6bd0686d5084ac7e92c687fc72829288aa7d9c823de
TLSH
T1B7D08034FB45B745C78605F2D514A720637A864534C2C60DB1A2D50D98681D0B7E79F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0f06119439d622a1a5078cf90d2c84d55bc25c179cc319a31bc271a3e62dc8b5
MD5 39897ff436f6a2795449c696417893df
SHA1 b1e15f7b2c6f5ca94bea9d8a160cc9e6864c1d06
SHA512 75fae24fb44003376ccf64d6c3715357ca6f73fb6cca4422a2574a4960dc75c830ef617f5476e7fc21942b321e9fe764ebf9ae64abfc2b05a73fdd7fb96ad95e
TLSH
T1F2D08030FB45B745C78605F2D514A720637A864534C2C60DB2A2D50D98681D0B7E79E7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 97b90b9efe590338ac488e43e96bf347f40982f17c0938e9cffb33bd6fe291b5
MD5 8c3c06584d9183d9c83c0cc0499a2585
SHA1 ba1ea659cc753c9431c2107af322ee08bcf09a94
SHA512 e0e6ee2e12c98239dcea2a89b41853ddd3b29ca2f5c1a6c997f41acc43f96c3bbd46aa2107b43646e0295fb1d76f85a97728c21d878779fd7db8156cc6feff6f
TLSH
T14071A35022A414A6CFF06777BBF3BAAD37B2C9433E032E0D7860727D9942B412091468
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594368.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594368.TMP
Size 3KB
SHA256 9aeeada68a49da57fbc90611d089a5db6ced083cf1d7d611c1938bcf533fc54d
MD5 c7f287c1e05d7e6632c35a1656f420fd
SHA1 c56b16a6b00f8799c27accf471b3c83ae4611ee5
SHA512 4bc22a32ac98b54b429ced688e9828c035010b332fb337f6f6d81e4aada02fe479b6ce58774912157206a01fc226d9a4702adcd1b695602654f3e90c6a761130
TLSH
T13171835062A414A6CFF46777BBF3BAAD37B2C9833E032E0D7464767D9942B412091468
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d47813e3181fb4e0a1893dc055e010be701a1606540c45c3d81234a41efe3f5e
MD5 31745bdc71a382448a77d4ebfcef6c39
SHA1 2bccb38bdacd2de81a8c122626c1f61c98837998
SHA512 c57395f1b5c5810195c16448e71583a242312d2a91bf7189bfae863021c3b705a08dd0e6ba72051a6a0ffc02a2a46106ed2d4ed80febc334c8408fe398b5a4f1
TLSH
T13641CCF3C3E8853E991186F4BB186E2BCE1D0914436C3C5AC9E4AF5BA3E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ea80fbc216de0e5b8928e8ce56e38dde3b2c6e97a64805fbd95db42ff555b10f
MD5 04e91e25a4b0d9a6b6ca6c9f0c89b526
SHA1 fdc26fec357f83ab9f7e626c719bfe50a1950348
SHA512 77262a0806c2878ca3de7d76ed6bef4854c48cfeb0d62bac84110e753c02c91e287abb2927f9dfc32d863af6e1dd797da08409a1bbe790d6064467eea3c6990c
SSDEEP 192:sxRIR0yM/jK1Ml8UQ9FJ/fhsn5IyHzoA8peEk/g6+WNIYPrUZGftIgDEJ:sxRIGqbJ/fhsn5sW/5IlAxc
TLSH
T1AE62C916A66859778CDBE209FA557F53D6F85472B1940E44AAFCCB0C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5e3cd7735d952d189bf7671d0806fb10143e906f97fbd2a0888395f0a595b0f6
MD5 10d894944fb42bc5d157c078a88f4cfc
SHA1 4b3d8cac40105ed4615f3fb2e806fd2152766122
SHA512 25721c5a8c12954c7d8c2e0b158397ba891b4952acbde7d5d6e639fcfb75e9debb73b7c90f78032bb88fe6d0990757b18013a52933a4e1a2e131566fc606a7ba
SSDEEP 192:sxRIR0yM/jK1Ml8wFJ/fhsnSIyHzoA8p4Ek/g6+WNIYPPUZGftIgD+J:sxRIGbJ/fhsnSsI/5ILAxe
TLSH
T18062C916A67859778CDBD209FA557F53D6F81472F2941E44AAFC8B0C00E6EED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b10520c82a1e12402b8c8a1e4f60e950a3cf75ba23a682ccb78beea6da466d08
MD5 8153d8415946c2c916afa8be72d869dc
SHA1 cd7558899b6ed2d31f87842dfb94112763a8158d
SHA512 d8faed76b22a92b3fe4d97518a78f53cdc0a8a69ef64aa4620a113e8d0c429d9758557caf7dc517999f533f71e37e8db2886f9c465103f034d8fd665280ddfa5
SSDEEP 192:sxR/R0yM/jK1Ml8wFJ/fhsDSIyHzoA8p4Ek/g6+WNIYPPUZGftIgIJ:sxR/GbJ/fhsDSsI/5ILAxs
TLSH
T14352C816666899378CDBD209FA557F53D6F91473F2940E44AAFC8B0C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3261c7efb20e5d75d0f9844cf554213fe4578ce0f8f9ff42542702374439b9eb
MD5 96793d69bcfd224d0f975a6fc9e2ae98
SHA1 56c81a4976d03ddeb6f247da1a989ef4c23ef7be
SHA512 bd49819f97e57aeb3bfb1993e128d2014c0693db4e02466b9f7e7c8a6624084ad4779b12b1675c284d681686108ce62b0309dcee80986343c750a4783721ff90
SSDEEP 768:LKKg6xWgdVf7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ3nYErouevdWBmC:LKKg6xWgdVf7ku1jaY3YPuevdWBmC
TLSH
T190C2FC2F240CCB7E4F844E9DAD2ABE976DD801CB97584D9447EA880C03D77EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 aad6e6ace20c25baa3178c6b6f3c2ed1a510cbee285d5573e3ff19e44036a07e
MD5 c8666726b121f313ce4da52c9ea17593
SHA1 8f8828e70fcac05800ae53dbeb28c7c92d32d213
SHA512 62a26a580082ee52e783599432854ba9088d87020be8ec299e6b0a041d0441155f310661730001dc6694758a284cccc0a28427e4425f6e4770d8436c2b5c0090
SSDEEP 24:KL85VuJ8mLoI6+AyoJIlS6KEJh8M61CCqSwYK5ayzyXeym5yvycy78yoLy6yuykY:KYbINKwEYXyZSIfKTC8fDIZKA4cvyV
TLSH
T12F91641036BE231138BE290CA4A5896F178134B3746AE67B37BC34E65D66E402FFC5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b564d50215c8859e1076878e43bcbb00c8c306e0e64cec708701fdfeccb6515a
MD5 8b46aea22e02ca15e37893733ad4f30f
SHA1 c51cd320bb8915667de9924f55cbf7f1e09d477e
SHA512 d38f5333c6b39b50c9b34c6903cccdc0334acc8a2620df70ed40bfff517196fe3d67b82ea5995253290fa1b7133f16c55b5b26916f2f2f7d5618039f85c00723
SSDEEP 768:7lj+9v3UEcOzvt1MtZ75riXYUsZUgb9eHcmzn12bfr:7Q9v3WiIUsZUgb9sXByr
TLSH
T1A8F2C076ADF88C534CE297C8B22A664B6FE5406391C81AD89DCC9F4D05D76EE430FC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3c6e8708a7ca8fc8d11b29466cb46b009f636025d08acb6610779d89f2ed3876
MD5 03beb0cab75dd0dd2c0406ea925d1bf1
SHA1 73775c1a8a94aa081c7d2438967ae3567344ce62
SHA512 f28138d01e364318fb21977a9944bc9a0858d439326794e2e51a221c0e9da8585d641ad8dd418f0f1ffa60bbbc44474ebd1dafb71fca14e4bb3bf46ce6c7daa6
SSDEEP 768:Clj+9v3rEcOzvt1MtZ75riXYUsZUgb9eHcmzn12bfr:CQ9v3tiIUsZUgb9sXByr
TLSH
T1C6F2C076ADF88C534CE2D7C8B22A664B6FE5406392C81A989DCC9F4D05D76EE430FC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 e57ca202d8e4adc02696ff9b70585d5e0769b5311059313500892dee2becf638
MD5 fc304b4e9b93bcfb8d570f009e8f3fc3
SHA1 0703fe9144eeaf9cf46cb97b1fcb550c58bf6914
SHA512 de57dc260eabd9c717b546ba6c98fcaebb6a66e2bd8650c7dda98f30843e1a09e64dd74f3915762fe6f10e2efc838ed56b2e4c51f90df4a01624717b73ad395f
SSDEEP 768:aaF1j+9t3KwgGEcOzvt1Mte75riXYUsZUgb9eHcmzn12bfr:a/9t3KiIUsZUgb9sXByr
TLSH
T12303BF739DE8CD6B4CE29BC9F22A220B6FF540A385C56598AACC9E4D01D75ED030FD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 91c2cc04445dabe464702dd3b26974f66c95ccab834aca23334e176eaca93b3a
MD5 baf833581ee5a0afb45b7413d3753754
SHA1 846fd8797e5a28cd458eca186cc193f06efe05b9
SHA512 8ec5313bc18943ad14e39f52649102e5264f53bb5e10df79034616b4823c898d031a52bc89c06cc7b3c17ac0a118384441de5761e361063991a35a865bf1689e
SSDEEP 768:ZkjaeqD4MlshiLdMmJ3lUIcOzvt375riXYUsZUgb9eHUo+ApXTcHT+:ZkqcjhIdMG3lriIUsZUgb9sF+KXP
TLSH
T1D303C07999A89C678CF2D6C4B36766472FB401A386C52ECCDDCC6B0D02A35CE530782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38dd46b6-d32d-4508-9409-ab7edc24fca2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\38dd46b6-d32d-4508-9409-ab7edc24fca2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download