7691aa5bbba9afd9912a720d0e3a344350702e76369f3b0e8768b9fce664a991

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
document.html
Size 5KB
Sample260703-pl59eshs2w
SHA256 7691aa5bbba9afd9912a720d0e3a344350702e76369f3b0e8768b9fce664a991
MD5 18a64b985b8cf654ac37d65cf8a9e4e9
SHA1 69db3110c088657670e91fbf8f46cf8fe29fd44f
SHA512 a198fbf83a9bc540eb1febfa086c656c7765095ef933322718b91a30b26ef53d491f7384d2d2dc745a2820daad538739fc87ac86fdf17665e9248ebad0aae4de
SSDEEP 96:y0+s+GoJ+GJGJ+nJ+SJ+w6CJ+w9o0UJ+wSxJ+wBJ+wkKzJ+2kPDLJ+OJ+OJ+OV:AkYO
TLSH
T19FC1A610C32A144691F58DDBBAE777251048C916E2CF9E61A36E8A3DFCCE97137403AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3668	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275551703159734"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{D8F9C93E-F0FA-442E-BE45-A68B8B791FC5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 3668	4772	msedge.exe	87
PID 4772 wrote to memory of 2388	4772	msedge.exe	88
PID 4772 wrote to memory of 2388	4772	msedge.exe	88
PID 4772 wrote to memory of 2388	4772	msedge.exe	88
PID 4772 wrote to memory of 992	4772	msedge.exe	90
PID 4772 wrote to memory of 992	4772	msedge.exe	90
PID 4772 wrote to memory of 4600	4772	msedge.exe	91
PID 4772 wrote to memory of 4600	4772	msedge.exe	91
PID 4772 wrote to memory of 856	4772	msedge.exe	92
PID 4772 wrote to memory of 4600	4772	msedge.exe	91
PID 4772 wrote to memory of 856	4772	msedge.exe	92
PID 4772 wrote to memory of 856	4772	msedge.exe	92
PID 4772 wrote to memory of 1428	4772	msedge.exe	93
PID 4772 wrote to memory of 1428	4772	msedge.exe	93
PID 4772 wrote to memory of 1428	4772	msedge.exe	93
PID 4772 wrote to memory of 3740	4772	msedge.exe	94
PID 4772 wrote to memory of 3740	4772	msedge.exe	94
PID 4772 wrote to memory of 3740	4772	msedge.exe	94
PID 4772 wrote to memory of 2152	4772	msedge.exe	98
PID 4772 wrote to memory of 3520	4772	msedge.exe	99
PID 4772 wrote to memory of 2152	4772	msedge.exe	98
PID 4772 wrote to memory of 3520	4772	msedge.exe	99
PID 4772 wrote to memory of 768	4772	msedge.exe	101
PID 4772 wrote to memory of 2024	4772	msedge.exe	107
PID 4772 wrote to memory of 2024	4772	msedge.exe	107
PID 4772 wrote to memory of 5000	4772	msedge.exe	110
PID 4772 wrote to memory of 5000	4772	msedge.exe	110
PID 4772 wrote to memory of 5000	4772	msedge.exe	110
PID 4772 wrote to memory of 4544	4772	msedge.exe	111
PID 4772 wrote to memory of 4544	4772	msedge.exe	111
PID 4772 wrote to memory of 4544	4772	msedge.exe	111
PID 4772 wrote to memory of 4700	4772	msedge.exe	116
PID 4772 wrote to memory of 1704	4772	msedge.exe	117
PID 4772 wrote to memory of 3460	4772	msedge.exe	118
PID 4772 wrote to memory of 1300	4772	msedge.exe	121
PID 4772 wrote to memory of 1300	4772	msedge.exe	121
PID 4772 wrote to memory of 4896	4772	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\document.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fff9d66c188,0x7fff9d66c194,0x7fff9d66c1a0
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,15078170222195186445,537901892245335672,524288 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,3571867462214183219,4218181859942630871,262144 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2052,i,18404743431670761551,14008805707312133347,524288 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,7258196662332210580,9327995574720438321,2097152 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,7545420580518094795,2616041620008358503,2097152 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,6834615321796132537,1723575678362662159,2097152 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,15975337405740580268,15192069831045151341,2097152 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:2
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,8792044773756374441,11370569655369601712,524288 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,12170340377885456949,8998524097447698242,524288 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,15503458620353313383,921197425595853292,524288 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,15503458620353313383,921197425595853292,524288 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,4271377358592248082,2790000589323265691,524288 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6416,i,6417635167509142296,6519667033091816182,2097152 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4016,i,3294313852793263015,12868450504241948895,2097152 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,9978636174519210565,12590370159761912139,524288 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,15521379800738444055,17755068454562904745,524288 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,3760702359434051832,18253536560837385917,524288 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,10904571941828911452,13918551169019174180,524288 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5796,i,17931760854532687117,9176205283560831093,262144 --field-trial-handle=2220,i,3664327297983328757,3209437135338198123,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

515505ff-1fd4-4ed8-955f-9788130ac261.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\515505ff-1fd4-4ed8-955f-9788130ac261.dmp
Size 8.6MB
SHA256 afc45ad1c286ad3393c2815382f459fa092d5052a8af3848611227b14da516b5
MD5 644282cf599b99e0266647733ce24233
SHA1 7d109394e194ed33fa33a69468121ffe361c0b78
SHA512 71cceeab718b812cbba255c0585f1000ce08959990e8ab53720418ab063496ef761c24de3fa43a6055863a79c7f268a513347fca2011d7c0058c2be8d4c0a449
SSDEEP 24576:bB5qi80e9Rb7Tm4u8CngXbXdMjfWXWTeVim:t5J8r37UngXbXdM7WwG
TLSH
T14896D556B3C18A8AF02546B668C7F7B1E7F9FCD14A429B5B3604B32C1C3B6486F11A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b7f070a4d3175a30ab1f73e5c86d8af917125a0b9ba72da395511cdb1d406c6
MD5 bc3e311326d2799984bcb4de5723ee07
SHA1 2c2dfb72259a6daa964eb7a402ee00bfd5f5217a
SHA512 6c40c35ca92f726c413299822798ea8c4de22875c9fdbcb3c3186bfb1444faf40cb63b86b40b1a70191e14627bc482df4bf291d36b77367e2aac76d3c7e3f85e
TLSH
T1DBD0A720BE24A896D23A21B255204700AE5454A321668185A124481CCCBD885DA96796
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

4d765f6b-f731-4a70-9dd7-a8cdadbc1b6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d765f6b-f731-4a70-9dd7-a8cdadbc1b6e.tmp
Size 13KB
SHA256 5a6a181f4534952ecca7b2212511a4e9594b2f32d375acabe8acd35107b11960
MD5 882a8269b025a3f58d9331c065c9c3fa
SHA1 7d15d4fffcbd187480728ff284cb34936b560ced
SHA512 0b8b01b8571fd255ae9be26e70e46eef6302b3ae65432703e48149e231e12ec14850d445343d0d93d9b947d638504c6512f0eb34e42422a443b5c4f88dfac724
SSDEEP 192:sxZcuTkR/eyM/jK1Ml8M9Pv/fv/sPRvUCLczV/pIYUcaSjpdcjHW6+WNGYvYchTv:sxZs41H/fnsppUu8sHbGbx5S
TLSH
T1D652C712AA34697BCCCBD20DFA45BF53D6F55472A2901E44AAFCCA0C05E7ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56153671-d6f3-453e-a15f-563fe9683090.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56153671-d6f3-453e-a15f-563fe9683090.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 416384a11284a2c5255e17b745e2a9e4cd46ebb2e295efa59e0dd01b3d75a935
MD5 13c04ef7c4c32ccf75c736bb144e5ed2
SHA1 bcb8e679d2e9797a5e2d8f6b619f280e81990650
SHA512 00a1845be0f3d8e1ba676b6fedecd5706d1f4614b498ddebd57b38737a6bc2e8b9d3741724193b2fc487b0d40a6a2e9175e5182e0669bdde28dfd9b038de0ef4
TLSH
T1B461C537054A4C20E7600D3195EDD224B976A6EFFD0FAE842190D8711603FB2B6D5D79
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8fad1c2bbfab3ce70ea128725af233815c1efb2d8bce61e35dbde5820c14fa33
MD5 930e6c4efa3b2b0043f46a8f3906753d
SHA1 2c65928bf4e68ed9c798ed3989613987bd395f1d
SHA512 83b28676a9d7f72fb9f893f2092a77cbb654fc3205ee6acea8f126b17845843407bdfbc8744b75b5877f035947083f76c916d6484874dc5729ff59e5aae9a6a4
TLSH
T18321A0F783D5856EC91556F06A24BE1BCE2D0501431C3C5686E4EF17E3E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c6be509967c418da3365f0f3db58059a11ed5fb15a5121cb370b0828b3b0510d
MD5 3fec4d836202e63c773790ac99bf16b4
SHA1 4bbd4b486e65c77f23e2ec2b19cab2ab3bc1706e
SHA512 970b0cdce44e3118f5c08de7b5e62071ecab1896829a3513bbefd44c0aea52eeb8f8b3a6e8a0ab21b91c01378450d799ffc2dc72b07a93e8794842ffe0830062
SSDEEP 192:sxZcuvkR/eyM/jK1Ml8M9Pv/fv/slv8czV/pIdpdcjHW6+WNGYvrcrTa//tIgUpJ:sxZI41H/fnslknsHbGWxUT
TLSH
T1F452D9126A34697BCCCBD20DFA45BF53D6F95462A2900E44A9FCCA0C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a3ccd9c464159aba89c6fe55f8a6b25616dc86db8650d412e1bf3ef75581b65c
MD5 9b8a0b0664007b616e034b4c1418d94d
SHA1 7e8d5eccb8f76532d9e58437e22149548d57e1bf
SHA512 ef3acb3c0f58ebd81432fde252670dc7d16ae2e3e85ecc64fa14138861b461b7549806d77e0c6c9b3dec0b04db785520fa917a93878699a11da28e35c9c0da17
SSDEEP 192:sxZcuTkR/eyM/jK1Ml8UQPy9Pv/fv/sPRvUCLczV/pIYUcaSjpHcjHW6+WNGYvii:sxZs4q8H/fnsppUu8qHbGNx5S
TLSH
T12852D712AA34597BCCCBD21DFA45BF53D6F55472A2901E44AAFCCA0C05E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 11dc19acd12b6f7c892a0168e02fb4a1d3e31a5e513730a956fb7c4d71cf50e5
MD5 95dd21458a692f6ea02e96ad68886405
SHA1 408b963c88c6e0c71bca48078a30137a9286e681
SHA512 560304116452d5e290e827b4b6b7aaaf36baef1e6cc9ca5ec3221b819cfa09152a0cc52519e73dd4987eb3e656edb5f8254067ca22fa7a0c3d37f8fd3e4f0460
SSDEEP 768:GQseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppdroYtu:GQseJ3xWvhfynu1jaVcL88pWYM
TLSH
T1BED20C2B680CCB7E4F844E6DEC2A6F966EE801CB57944D5487EA884C03C77EB51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 84fec1b3a9dd95978ebb9991696c932403baaef5696c1f440d4049ec5a78b847
MD5 67334076057001e72f51d0f4a009fdec
SHA1 fe70e8b4b0e3ca52229ad37aa768a4ae890ac473
SHA512 ba2361a4031b80574e382b10c3c7c7d1cabc94cf295c9992b7abc2edbc84477c11752ebc3337e985edde440a40d992577c79cc67b44caa761d2c1b4b9311ab83
SSDEEP 96:KYH+KggmG3GKIY+iGEKr6+2fuKoAkstY82P:49VNPjdHstY82P
TLSH
T1C9C1354A313B061338BD2489B39695364F4232B73058A8BFBFB900565E6BE125DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594db9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594db9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 c23321d10e43686619273cc42404d71678e37b5be6484d2cbc2199442bb70616
MD5 54adf3d8164f91ea42ee5ff472018923
SHA1 d9c5f9bd25762dc8c45ba4fab8e24f460a580ae8
SHA512 fdf0d8640b83d649425ebeca38bceb8c268ed7634ee2d89d16c7cf4f6d49c4a84cbcde9b6c283db2670a1e9be9834a80b913863f48df3773ac449e6b48d51a21
SSDEEP 384:7iF1tNn/s3n9SgzsN58TUNTUlIlS58E7rX2gJ2edZyRk:WF1j+9H0wgNE+gJ7fyRk
TLSH
T142824C335C64D93FAEA79A84F54A32079EF4416BC6C4AAA4F6DCAF0C01DB29C130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c7776ae5c0d254cb619e69a1d414ad9feeceb5312adf07253818208a794c68a4
MD5 d2641a3dbd40af1fce592517c8a941fa
SHA1 0b6d35a145ab908318c48ad613fae2f90eeee232
SHA512 274abeaf82f833604d42857c70b24b95faaf59c9306fd18b9eb16a6f2190c02cb474a16bf188311c4a53d73b3791dfc78e5997e8b498f7fab1fca6cd2ae9e8d4
SSDEEP 192:lONZ6vMtPQmiUyc6c/ThTCz+FdLv847ZNfU/u:lONZ6UtRLTNdTbU/u
TLSH
T1F8020835AC786C6BEAA3AD45F48A27175FF4216FEAD05B54EAE82F1C01D764C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 edae1a25b0aa580b3593da086f4d1d4148debab84892ceb0906565cae057b176
MD5 a9cb95ee0e64290f8ebe02c14ed8f5ee
SHA1 8ae734513a5fda3ee3ac435b763cc5e4652bd345
SHA512 c30eed28496b3ff03b5d9dc040212153ad2097be36e2e197aab986f25cfd9466e209c67df7266400de8b04f245a8964f39db35667f1ef4c2f31b2afe76fdda97
SSDEEP 192:udCTSNWMsnMcPPQLz3XX9VofsNe6hVQu8sMM7CFBO5QmiU1c7AcdTu/n4MTCz+Fp:JtNn/s3n9SfsNn758E7rXcg4edLyRk
TLSH
T17B625B326C39AD2B9DA3A594F54637079EF4816B97C42F94E5DCAF0D02CF26C130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 45d3bb0a0308eef8165b39c7305e0162e3d51fc7c8daa6cdf21426115d88717b
MD5 8c4687dcf21076502574da93045f39fc
SHA1 e38c0623a4f9e537d34fcbad3ca0a21f697fa969
SHA512 32aba3fcb0a142ae29aa7320e7a362d9bee3cf9f527ef35ee88957098537640f5e60c51027d52ab7ee2f7e2ec0d724d756aea4c66388e32871953dc6e6d83fc4
SSDEEP 192:uPVCTSNWMsnMcPPQLz3XX9VofsNe64VQu8sMM7CFBO5QmiU1c7KcdTu/J8BMTCz+:dtNn/s3n9SfsNnS58E7rX2gJ2edLyRk
TLSH
T165625B326C35AD2B9DA3A598F54637079EF4806B97C42F94E5DCAF0D06CF26C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 d933d22ce87e695a42c074b853d0d21682cb9d9c9ac0670b15c640606ee334d2
MD5 11255e40261c577509ba4010f832d068
SHA1 a651ae85917671ad541cda8475a546b98b3e7ea1
SHA512 8fecb6729a44515245ade795424f01f4b066ebf059a6098c1e494b70034b7ede7320c114a4d8bfb364c6cea5dacad0081f383bc655f722e45b86a6848135645f
SSDEEP 192:uQONin6vMzOPQmiUyc5bc/ughTCz+FdLlf7080IZHqXU/u:LONC6UKR4zNdXyU/u
TLSH
T15F122C32AC74AC6BAD93B591F48A32075EB4812BDBC46B94F6DC3F1C02DB65C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fe84ec-0d61-435d-8215-f8f7ceae983c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e5fe84ec-0d61-435d-8215-f8f7ceae983c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b851979da921effba80a12e5910285e4cfafbc18e42445f88fba195c3acf6aed
MD5 3b1cbbc12356b9406a3f7f6e3c95a6f1
SHA1 5de3155ba0a7dfed645171f75862189e3cbe89b0
SHA512 7dc00efed2544f22758e77ba52999adea394ef6df7fde1dc39f575d108c00dd7981a79931c26eeeb9c2f63b0facfc5c63d6acc9730b1e9d4c7101d8552873af8
TLSH
T15D41189CB6FD1148B3776E5AAFF6A8AD487BBD772E06945E00110E4E0626A40C871733
MD5 SHA1 SHA512 TLSH

Submit Download