981f17f089ed43a21ba7ab2ee85a3097a20707cffaecf5dce8261d1bd6e48050

Analysis

max time kernel
300s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 06:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 1KB
Sample260709-hkhcmsdw5j
SHA256 981f17f089ed43a21ba7ab2ee85a3097a20707cffaecf5dce8261d1bd6e48050
MD5 aff0f5ddc433c0695d14d5a105a6372d
SHA1 b45bd1a9ff13ecacbc3ba921eb8526b0d31abd5d
SHA512 9c80951a72be82a900c9e7a4c3ccf0ffeb4b66b2025b8c30a2a2cea7277f5ffe8100cfed3beba98315a9c9e5dab1755ae147a004cf25a838b373e63747bdd1c9
TLSH
T121317A4BF210091B52F3856EE213FBAF65C15740520B817124A1B397ADDFDA1E3D2BD8
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5912	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280532705706127"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{62A8154B-B9E0-432A-9286-78A43D9C55E4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 4128	1844	msedge.exe	87
PID 1844 wrote to memory of 2072	1844	msedge.exe	89
PID 1844 wrote to memory of 5912	1844	msedge.exe	90
PID 1844 wrote to memory of 2072	1844	msedge.exe	89
PID 1844 wrote to memory of 2072	1844	msedge.exe	89
PID 1844 wrote to memory of 4536	1844	msedge.exe	91
PID 1844 wrote to memory of 4536	1844	msedge.exe	91
PID 1844 wrote to memory of 2668	1844	msedge.exe	92
PID 1844 wrote to memory of 2668	1844	msedge.exe	92
PID 1844 wrote to memory of 1812	1844	msedge.exe	93
PID 1844 wrote to memory of 2668	1844	msedge.exe	92
PID 1844 wrote to memory of 1812	1844	msedge.exe	93
PID 1844 wrote to memory of 1812	1844	msedge.exe	93
PID 1844 wrote to memory of 2348	1844	msedge.exe	94
PID 1844 wrote to memory of 3412	1844	msedge.exe	95
PID 1844 wrote to memory of 2348	1844	msedge.exe	94
PID 1844 wrote to memory of 2348	1844	msedge.exe	94
PID 1844 wrote to memory of 3412	1844	msedge.exe	95
PID 1844 wrote to memory of 3412	1844	msedge.exe	95
PID 1844 wrote to memory of 1096	1844	msedge.exe	97
PID 1844 wrote to memory of 1328	1844	msedge.exe	98
PID 1844 wrote to memory of 1096	1844	msedge.exe	97
PID 1844 wrote to memory of 1328	1844	msedge.exe	98
PID 1844 wrote to memory of 2856	1844	msedge.exe	100
PID 1844 wrote to memory of 4824	1844	msedge.exe	104
PID 1844 wrote to memory of 4500	1844	msedge.exe	105
PID 1844 wrote to memory of 3184	1844	msedge.exe	106
PID 1844 wrote to memory of 1044	1844	msedge.exe	107
PID 1844 wrote to memory of 1044	1844	msedge.exe	107
PID 1844 wrote to memory of 2560	1844	msedge.exe	109
PID 1844 wrote to memory of 5384	1844	msedge.exe	110
PID 1844 wrote to memory of 5384	1844	msedge.exe	110
PID 1844 wrote to memory of 2700	1844	msedge.exe	111
PID 1844 wrote to memory of 2700	1844	msedge.exe	111
PID 1844 wrote to memory of 1216	1844	msedge.exe	112
PID 1844 wrote to memory of 1216	1844	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd90c6c188,0x7ffd90c6c194,0x7ffd90c6c1a0
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,13444192908013703087,11432807454702283497,262144 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:2
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,12566416354570883730,1367717569931219195,524288 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,12282826725023917468,12872632963241223335,524288 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,5011974510987382812,13403815128260590101,2097152 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,9449281230422562340,18256783337213401567,2097152 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,15387558888229279736,18045853912934780726,2097152 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,6273442607619513719,11497979246572999525,2097152 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:9
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,9908347097413399802,11213983423607538039,524288 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,16131952157926506233,13727581164602359153,524288 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,16817326543528839875,17392330693038621304,524288 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,16817326543528839875,17392330693038621304,524288 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,1547736303741124127,10476207824418780607,524288 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=1236 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,3561130233655601365,12618606649209572591,524288 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1408,i,9875922657436698946,12905801362552439585,524288 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,1738465560069012889,3489735249355552676,524288 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,14527426846008948371,15776598089223291631,262144 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,4634377142882536453,3034603224948330417,524288 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,2282021855460817932,6248797542762438447,524288 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=1380 /prefetch:14
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,17772954723339570389,11961310509694245111,524288 --field-trial-handle=2852,i,18422254691507154912,17366921308182828072,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:1216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 9abe201ccbf4ec93a68bef814e80d5b522b879e1fbffd6c03cffde1199315bc3
MD5 ad07895c191fd6ba7618a7deca7b5ce3
SHA1 041b785c78d2145444b9c20fbb38cd7084dfb2e4
SHA512 6dcb5abab7b3810aed27c07a3a7e9cc3586f1b8007cf63ea992336c3cb6f423cdaa371121024b3f8387859e38b55053e93f80cbfc198353c294ed6751d2cb3bc
TLSH
T17F21A9D4C7F91BD2DB6C0DBE1DE2139B3271E82AEECFEF500804A27948067636902530
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 881e4ea33594ec69837cdf4362ca59a62af8b21f534ac791eb54c193ddce385c
MD5 73c01c5a7c3dfde98e108822b8616d1b
SHA1 ae8c2d3f71ed267f83de38f1488835c145dd2c3e
SHA512 70fb9de706c3ec0648b5c2487fed878a4526b988b2c619c1bf3c275c85da77144b6114b41d808eb0e878fc04e558a52b6595f2f0735de96fd03c96e472beabe4
TLSH
T10131BDF783E4857D8A1185F4AB086F1BCE290915531C3D5AC5E0AE1BA3E2471E141D5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 31572f48968e3ebceb72954fe7ab8a7eb921d446a6a9dbe05d4844d35daf698d
MD5 3fefe79bb9845d5394c64c62ae4ffb3a
SHA1 8fdfa57a6d6facbef0250c4bd94dc092768851bc
SHA512 d352afed58a22e95d309fc201a3d1e5479905f90118b2706902c2b012ed696080cbb26000fb66d031acf315704be63ee8fe1511a85302ede2cec9b6ca6394f0b
SSDEEP 192:sxRY/ywF6KOMl8UQUby/f3sOzNQ3rgd8szoA8peS/g6+WNIYnatKGJIgDkJ:sxRYZqSy/f3sOSkedB/5I5Xc
TLSH
T16462D916A6289977DCCBD219FA557F53D6F91433A1901E44AAFCCA0C01EB7DD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 274172bdea206420260a28afa1dd072f010712a522cd2ac66a7bbb8c9af80a8f
MD5 801b5bb5b7f77d5c1a27e110837234b4
SHA1 9ca40c3c367d5e57e88df5d17b85421553885f37
SHA512 a525e188c390463712da423278e4d4a15071804bbbbb33645021172a44773af81eb4df8d25afc4f8d5c0ab153211c5cc9b59fbd3757e0c5593a75656951d2973
SSDEEP 192:sxRY/ywF6KOMl8wby/f3sOzbQ3rgd8szoA8p4S/g6+WNIYnotKGJIgDeJ:sxRYZly/f3sOokedX/5ITXe
TLSH
T18F52EB159638997BCCCBD219FA557F53D6F91433A2901E44AAFC9A0C05EB7ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9f85cb202d389c6e69e1b69b9a4db45d9619dbc6e4feabd173a886beb25e55c2
MD5 4648ff7c8f166ca1d1835c7de9253ca5
SHA1 d3185afd7f3791db9ecdc5720acc124a12c53edd
SHA512 d7ef0d32873c8c9db7b549e87b3d86d8da080fca6a5579d6ddf57865d7dfcf756a64962c181771e87a784cbf1f6af3069fcc5dfb5a49ee477161f641471e0e90
SSDEEP 192:sxRH/ywF6KOMl8wby/f3s0zbQ3rgd8szoA8p4S/g6+WNIYnotKGJIgIJ:sxRHZly/f3s0okedX/5ITXs
TLSH
T1C352EB15A628997BCCCBD21DFA557F53D6F91433A1901E44AAFC9A0C05EB7ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 665d819b9c2750c01943d70af000253c9d6099dbb908a411f582e6c46f164a9c
MD5 b65950834e02324e9beabb221ef2591f
SHA1 7d6ea8228e4c24fc0d5c4bca5242b4789d330474
SHA512 7bcde3cb64883a566f9daf3656a3e4eb705593a78ebaacf5694df0b4b33e361056041a427292e723b9e3cca10bb2c66246d2a434c866406b1484f7f592a02674
SSDEEP 768:Jl6h92WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxXguEroMgCBF:Jl6h92WgqcfHwu1ja4QuPMgy
TLSH
T186C20C2B640CC77E4F844EACAC296E966DD801CB97988D5447FA894C03CB7EB521A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5af696.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5af696.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 1e226241b79bfd05422a9017ad3fa98c859505abaddbb353eecc848e6b75d489
MD5 ba683ac60b24ed524c15fed7a492caca
SHA1 4bea4c572b8632f9e4447486d5b4b49b91097275
SHA512 1421e94f3b0b077c38fe85c58db6e1754cc13a25adfb33845c76d6a68cebe6c567aa9a52483d7eb2ddc650b891e675871f6e4a1e44d0fec121c2abc89e5327b9
SSDEEP 768:Urv+4UNbdM3+2YreNSLfFfAfrjX7DGFzoqPcNMCNFzeVH1Skc:UbsbS3CpfFfAfrj3WkqPalEH1g
TLSH
T16313AFB598B889364CF3C6C9B70B3A076FF4121746851B54D8ED2F0E479F5AD130BA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 68544388724e2fe3ccd9ebe8ece585646656d87f5929a6c758edd8cd909e943d
MD5 4a8b300806fb1d2e3916060e104b95ce
SHA1 99a4db47d1b839b6bceac4daf29978f6ae7b8943
SHA512 7bd184b416b7187d2dc980915cc1b624e36e159742fa30fd6a5b1eecf10b544e6dedfc96cb0a15278e7d50fa3d37d31aa99bd260ff5ef7460171178b5fe1ee3c
SSDEEP 768:vrv+4UNbdM3s2YreNSLfFfAfrKX7DGFzoqPcNMCNFzeVH1SkN:vbsbS3MpfFfAfrK3WkqPalEH1R
TLSH
T1D113BFB598B849374CE3C6C9B70B3A07BFF4022746841B54D9ED1B0E479F5AD130BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 e9257032868a65fe1eff5f0d4c7d895526c197b2a6cc215f1b60f877bf65c32f
MD5 4db4aa22c30ae96bdcc50a414df28fa4
SHA1 f2f4b95fa2b3a535ccf58004210f8e6709e6c18b
SHA512 c66969e08e52b3b7b926ad7172d876d40fbd5c50417f6e67024233e6bc0e43f716de66ec3d571ec7122bc6c3529c61a01039b7609d5e71b7e8f0327e8ef67527
SSDEEP 768:VF1j+9t3CwgOG2YreNSLfFfAfrPX7DGFzoqPcNMCNFzb9My:89t33qpfFfAfrP3WkqPalb+y
TLSH
T1B103AE769C94893B8DA3CBC8B71B3A4AEEF0427786C57A5496DC6E0D429B1EC0307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2b53acf0e5eab1f781c7c6373a9b94d1a7a81a70ea1b395775a43a149f4867a1
MD5 2f4da82568d12d847f5431dfbb858e7b
SHA1 51215749ffe3c983f92300321694b3b9183aad5d
SHA512 0d49351e3a6e212a1d18c91740d15e46c599432e3fff62590d7d89bde1e433e902923e38e424de564ce507453c060d7b8ec3d722899b99b23d89544b1a1f4cac
SSDEEP 768:Mj+9O3xG2YreNSLfFfAfrKX7DGFzoqPcNMCNFzb9My:L9O3xqpfFfAfrK3WkqPalb+y
TLSH
T14DF2AFB5EC644D264CE3C6C9B71B2A4BAFF0462746C42B5499ED6F0E46DF2AC0307929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4c3ffb6a0633477a26c88b7dc3a73b94acc8a5eab9d1f99b29f9f55e7b70946a
MD5 87221c67ff8c074123f8cdc40a8d58f3
SHA1 e994f57f5fc38cdb0a69bb07344de912c392ab65
SHA512 ef30eecc5414ebe88d9086ba33209e3f1651f809dd944e1979f47000baca5fe91d307e1845cf8236c1a5c928b39e6f999541652c7c3e1180c746f0915afe39fc
SSDEEP 768:Vrv+4UNbda39OYreNSLfFfdX7DGFzoqPcNMCNZheVH1SkM:Vbsb43fpfFfd3WkqPa7EH1Y
TLSH
T1A003BFB5A8B845374CE3C689B75B3A177FF4015346800B94D8ED2F0E879F5AD130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

241acb95-0fef-414f-b8cd-48fd60466872.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\241acb95-0fef-414f-b8cd-48fd60466872.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download