036deabb00d3e86eb6b691ee0c78a28ca132c8c1f65db87e63590c00a15083bd

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ddynoyjfrdbxxcpfnwnvih.html
Size 6KB
Sample260708-ag29msg14q
SHA256 036deabb00d3e86eb6b691ee0c78a28ca132c8c1f65db87e63590c00a15083bd
MD5 b2b36e8fac334e076e4f0fafb5d22f22
SHA1 8dead22fb4d09543f62681b5a02ebacd299a3fe8
SHA512 10dd2e89b169b58ea941f8c955549c883ce90263127019be807c61edf00e6fe29121d1e56112000f57346222d7ce18cfc06bc2c339a91fdd3fb907b679d4697a
SSDEEP 192:S3n3knrdyJqhYQ1jvtkEm9EV/PYEvOt/VAoLFY:VZhaLAgq
TLSH
T1B4D1425A28F3204146B3216903CB6514717EE947350DCDA83ECEA3489F86F39CEA3BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
22	1584	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1584	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279431183910774"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{C423A9F6-3587-48C3-9DAF-0F8CD29A6DF9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
516	msedge.exe
516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4344	4140	msedge.exe	86
PID 4140 wrote to memory of 1584	4140	msedge.exe	87
PID 4140 wrote to memory of 4880	4140	msedge.exe	88
PID 4140 wrote to memory of 4880	4140	msedge.exe	88
PID 4140 wrote to memory of 4880	4140	msedge.exe	88
PID 4140 wrote to memory of 4672	4140	msedge.exe	90
PID 4140 wrote to memory of 4672	4140	msedge.exe	90
PID 4140 wrote to memory of 2492	4140	msedge.exe	92
PID 4140 wrote to memory of 2492	4140	msedge.exe	92
PID 4140 wrote to memory of 2492	4140	msedge.exe	92
PID 4140 wrote to memory of 3852	4140	msedge.exe	91
PID 4140 wrote to memory of 3852	4140	msedge.exe	91
PID 4140 wrote to memory of 3852	4140	msedge.exe	91
PID 4140 wrote to memory of 1592	4140	msedge.exe	93
PID 4140 wrote to memory of 1964	4140	msedge.exe	94
PID 4140 wrote to memory of 1592	4140	msedge.exe	93
PID 4140 wrote to memory of 1592	4140	msedge.exe	93
PID 4140 wrote to memory of 1964	4140	msedge.exe	94
PID 4140 wrote to memory of 1964	4140	msedge.exe	94
PID 4140 wrote to memory of 552	4140	msedge.exe	95
PID 4140 wrote to memory of 552	4140	msedge.exe	95
PID 4140 wrote to memory of 552	4140	msedge.exe	95
PID 4140 wrote to memory of 1600	4140	msedge.exe	100
PID 4140 wrote to memory of 1600	4140	msedge.exe	100
PID 4140 wrote to memory of 4488	4140	msedge.exe	99
PID 4140 wrote to memory of 4488	4140	msedge.exe	99
PID 4140 wrote to memory of 4488	4140	msedge.exe	99
PID 4140 wrote to memory of 1512	4140	msedge.exe	102
PID 4140 wrote to memory of 3592	4140	msedge.exe	101
PID 4140 wrote to memory of 1512	4140	msedge.exe	102
PID 4140 wrote to memory of 3592	4140	msedge.exe	101
PID 4140 wrote to memory of 732	4140	msedge.exe	104
PID 4140 wrote to memory of 116	4140	msedge.exe	105
PID 4140 wrote to memory of 4904	4140	msedge.exe	111
PID 4140 wrote to memory of 2052	4140	msedge.exe	112
PID 4140 wrote to memory of 3472	4140	msedge.exe	113
PID 4140 wrote to memory of 3672	4140	msedge.exe	118
PID 4140 wrote to memory of 3672	4140	msedge.exe	118
PID 4140 wrote to memory of 516	4140	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ddynoyjfrdbxxcpfnwnvih.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9a697c188,0x7ff9a697c194,0x7ff9a697c1a0
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,15947325036002393011,2964059102039722515,524288 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,15407982445195326119,2155836723519931848,262144 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,9588217396811935686,17572156963382369672,524288 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,18385636001392679369,14697663818894946617,2097152 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,6219151685235070379,191024191641034048,2097152 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,4408677110893656685,7386775028625165613,2097152 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,7717230051748335893,5929239260583026634,2097152 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3576,i,7659330114948524493,1912047161816906020,2097152 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5400,i,12123895254318120820,3760568842225491966,2097152 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,1948964502175151056,3550280242001553740,524288 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,2001251831984748636,12058939449311529584,524288 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,2305015072786622267,16494342872297040154,524288 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,7555046753299907147,16365246977740521837,524288 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,7555046753299907147,16365246977740521837,524288 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,11411053792023369996,203417604465571336,524288 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,2329852919980519390,7343152955748905733,524288 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,2434932882196383304,17466086543623833904,524288 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,13276457237089496412,10013710973702778116,524288 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,16986703075269078979,9593275800156501451,524288 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=704,i,7521114778617884039,3505255482383057026,262144 --field-trial-handle=2268,i,13386337035326211361,6359960086199649051,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6cdf2bda74752f5642d1e68e27b73e8854a79ff386db5391078daa59e8d65df7
MD5 69b1d96ca6f8d6f1d03fd27aca4c2bf8
SHA1 d8862d1ff3762e8e04d04e336d2d688d212e434b
SHA512 529147602a38a8f5e50c5ee24a85e98ef738cbf1bb16a4004c8fb5612d2d115511997c910ce81ab57e6b20e885c064d6fb04c18d92f2207e9134b99ed35a8208
TLSH
T1617160740D368FA6FBD041BF51F3E255747582D8F4131E36D19056382A2EF28A1ABD4E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584b0e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584b0e.TMP
Size 3KB
SHA256 8b1fdbf3bee03dc8c831876159a67cd7e80f13183242528574939796f43b50de
MD5 6a8e9b124bbf6588a9b42de126888b03
SHA1 13618bc6cf0f23f0d74c8c0fcca373b1ce61be49
SHA512 b4499569921359955cae9c6e1442f43aeb2c65c4124698f385d8c7c565d3ee0a7dfefef081aed2db56c559e0efccf7d65fd8f9ac588481c17f0bec5c61d0b245
TLSH
T1C4715E740D368FA2FBD001BF51F3E255747582D8F4131E36E19056382A2EF28A1ABD4E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1b0dd9dd67677ce3723566c33ee04b5372fb7ff597b18bb2652ec9c5952da15d
MD5 501b7a31b83921638f352310ca045df8
SHA1 7b4421c8d3ff3500936b7e8e2d08caf09b22a34c
SHA512 c4a1aef00c3cdda72334f57d44b5b5f6393b28e66ac9c65a6578ebd088ed4ecf2362093977e6cb3079baa8e913a2f24c9b87a9c49ff44f14fb0913de8a342537
TLSH
T17021C0F383E5857EDA1156F0AA18BE1BCE2C0515832C7C1A8AD0EF17A3E3475E002A4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 23e0282a2d6bfa77e649a18ba27ba1e4fc01f0c24299c778c623043a12c2b795
MD5 fce586e8f1f59d31e9ea53e0a3e964f7
SHA1 62b7985fe48ca5752f039618d887c93740b204df
SHA512 a70a8e8c4a6f0731f86a2ffebf87853a286463964b64e1a8e7c5a3dbeaca3c57467dbab7a4d4b2136c6f72693ce50e01c5465c74004cff9d72f96a9054a0fdfa
SSDEEP 192:sxZcRwyM/jK1Ml8M9z/fcsNw2/0IdpdiHW6+WNGYCkvrNBIgrJ:sxZcC1z/fcsNwut4HbG079
TLSH
T1BA42E8126A349977CCCBD20DFA557F53D6F91472A2940D58AAFCCA0C05E6AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 06b8340689b4f45b98c523b218a871225caad39343458aaaf303458a9e01368a
MD5 b4d03a79d41507cc14b3f8500bc325cf
SHA1 03e1951bd4e3fcc722af60daaff7d52b7e99faac
SHA512 1afe7e5e7f25b7a09cdec571bc8ed64648913ae531663f8c7c1e892db3f13dcda3351296c71aa8b8de4d54a095f7b05ebd7ba6008bf044cbb41a87ee431480be
SSDEEP 192:sxZcRwyM/jK1Ml8UQh9z/fcsbw2k0IdpHiHW6+WNGYC9EQ7srNBIg5tJ:sxZcCqjz/fcsbwxtCHbGhEQq75
TLSH
T13B52C6126A385977CCDBD21DFA517F53D6F454B292900E44AAFC8B0C05E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c6de5944bbbb00679b270bc2f964e14a5739b58823dce044df6d92116339973d
MD5 9c7683734c7c5f45494149923f87f4b9
SHA1 2793dc826833804891d920d167aa571c106c80de
SHA512 4e0c49d2b6638c7a1527a1ec7cd29361ae0fea49113f5094993a7ec5bad469854b06e6a4a95ab9de1c141939474e42431d2b2391c3507e8fb1dca36a8c33094c
SSDEEP 768:FC8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVAroMC:FC8bqn+WvSCt6u1jaCZLbWVLB
TLSH
T1A1D20A3B280CCB7E4F845E5DEC266F962ED801CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9bbfa20bb4e8d52e5d538f2a021b1b830880af8e0e310421239ddfcc3f589e9f
MD5 ae32023a5106777a05bfe7b0b47f3490
SHA1 0c838f4f47f7ab94e3398ad7b5eee3d1f8a1a58a
SHA512 f763e82b4315a7cdcdf504f9b28f1ec3128f4c2da1b00f981121ebac8e5ebd7b3206c7a8cad3df48167b4190b65a7c2f492e501b79f7fcce81795768f28510af
SSDEEP 96:KQ5aKSMayawK7aFnwVRnlV5WhOUgZ5K4QgX5cfXWJVKHGbqGAo5:YFXAnwVRnlV0hOlZzQgXGfXWJVKHGbq8
TLSH
T1AD915F01713F160138FE7918916299268E8231A73568E47F7BB908B20E7BE125EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bfdff300-9894-419d-b94f-ca0ae7e92a2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bfdff300-9894-419d-b94f-ca0ae7e92a2b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 926fb0901f10865f3d3cea40004dfac3c329318f4b8385a16105e25ac7daab74
MD5 307166a53c778ea4bdf503e80d8eb068
SHA1 b081beeca6d75bbc1f208ceed5a26c2eb2a22ed4
SHA512 8f0436cc11cf8180319665b652b30dc09f29ab8d14a707f73e09126ee2ca9bc4827092c51dc222009956e4235712df20a83033db987dd0dd2ff6ccbacb69bcbc
SSDEEP 192:u+LsNNUQCwY9Zs5LbiHsSQmiU1riUN4Ea+jiOm4HoEGVamGqaU8:3sNNU+4dMOJ3CEa++OrIEKuU8
TLSH
T11D322A3668385C726EE2A555F88B36539FE440A7CA892FD4D6DC5F0C00DBA9C234BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 75dc3bd728cf6af9cbc0bd139c4514ea5c55ef987c6fd4eb080b89bcc70958ad
MD5 e2d25ee419b4f04621734fa22a9d0fa5
SHA1 0de9dea9e240a350fdb7dd72813d7a020c21f03d
SHA512 638ed4274f9612fa38ada8bc13bace5035b1ef3a956510f035f2728b2c53709705df85c9919667a2958ef572e76c54df61f0c6520ea917188188e5249a6fac32
SSDEEP 192:vONy6Db6QmiUywAHBa+jiOm4HoxRgPiU6:vONy6u6HBa++OrI4aU6
TLSH
T14102093568785CB79EE2AE49F88737279F94106BD9562B84DADC1F0C00D764C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ccb935f821a181bdb6e29973f64fe55724e0831adea045e18f4f6fe2fe85d667
MD5 55cd4c0dd556034712c4637ede915d24
SHA1 c6721ecf84427759f05db2f31ba5c9a58c3fef94
SHA512 7af781e1ff5c10a821c7b90ec4de47786eb4364d752f19cd8df6461e4c2ed4dd44f8cbbe56cc3682f49eeb6c0d7dbd4fed362c354f04fb5db7d30608b62454bc
SSDEEP 192:LONY6DbsQmiUyfpAeBa+jiOm4HoEGwNzGqaU6:LONY60wOeBa++OrIEtuU6
TLSH
T170123A3668789C736ED2A555F8CB36138FE44167DA8A6B80D5DC1F0C01EBA9C234BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5f26a450ce29369dc5d8d97035c963702f5d6f25563907a0a1328450fad952fd
MD5 e2da150a9e2c24dd3082840ca658102a
SHA1 93009e81c708f009de0146103f155e681862077a
SHA512 7b9b423171fa6ef6eaa09a743aeca65230ec6f913756a89fa6e0d3e1346d72f022bf389e988315a587a4b5c4f024c71f1558a232f5e944bd7214266326d59932
SSDEEP 384:KtNn/s3n9SfsNNt+4dMOJ3CEa++OrIEKuScjmw8YE:Kj+9U1HG3pa/OcEKu1jnE
TLSH
T139928D336D385C626EE2918AF94B2A57CFB891B386851F84D5DC5F0C01DB6EC130BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 15ae99147f9d8098078c673fe74246af17e3a413f5755326366629a88d13433c
MD5 48411cd611f6308d79244e2d29f27bec
SHA1 c9db18b6fa17442a35ab70d75e9bbdbb438266bc
SHA512 26941ae55fe1063781edbf45e838e97a0b2847d269fe439ad4d44dbdd788db19d45d3827742675c6418619628c10420c2b6ae6d8ee4816ef1a5e2d215c31f7c6
SSDEEP 384:oiF1tNn/s3n9SSzsNX8TUNTUlIlt+4dMOJ3CEa++OrIEVuScjmw8YE:zF1j+9p2wgCHG3pa/OcEVu1jnE
TLSH
T185A26B336C648C77AEE68A85F94A2617CFB440F3C9866A94E6DC5F0C00DB1EC034BE25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6d75f76fa435a29590ce23e8a295ba31c2cfaef36c6dc9f6e4cbbc3d0272da2d
MD5 35aee0b926f922d779f5f542dade9243
SHA1 2e2b0c3916a8694f6b8cc7d2990e293f9be4f513
SHA512 a2a775b54e1cb7228d96008227b6e0b395fb4ce64d910fdf9bc0847ac5514b01e46b31127248d97bdd4eaf5d7cc531647739a62a78db86d1be6b55ac778d44d2
TLSH
T1B641095CB6EA1148B3766F5AABF6A86D487FBD372E0AD45E00010D4F0A66B41C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download