fea2b14010dae5137763386d7c6572b9249e7051a97af305cb14fbf5eaf177df

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 637B
Sample260718-akac2ad12w
SHA256 fea2b14010dae5137763386d7c6572b9249e7051a97af305cb14fbf5eaf177df
MD5 88b7ad38e359594af600dee8c4723f83
SHA1 dc0665cc0a55965ea42cb1776e1fbbcfac6158d7
SHA512 ebf4a2e935fbe886424aed80426f01f6f322eddcbb912816f2b31c5ce7a9c9e38d661026bcb3b149d6f0c5a8e92ee733095317c8ceb6f055fde03acb07e19c4c
TLSH
T11DF00CC788908C8D0229A3687CF0B004B8434A47F7CCC5E0BAC4F1D01F98B25C0DB25E
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4080	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288073535227114"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{B1595EC0-3147-4D0F-9FB1-569552AD024C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5552	msedge.exe
5552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5192 wrote to memory of 3308	5192	msedge.exe	89
PID 5192 wrote to memory of 5296	5192	msedge.exe	90
PID 5192 wrote to memory of 4080	5192	msedge.exe	91
PID 5192 wrote to memory of 5296	5192	msedge.exe	90
PID 5192 wrote to memory of 5296	5192	msedge.exe	90
PID 5192 wrote to memory of 5488	5192	msedge.exe	92
PID 5192 wrote to memory of 5488	5192	msedge.exe	92
PID 5192 wrote to memory of 2256	5192	msedge.exe	94
PID 5192 wrote to memory of 4984	5192	msedge.exe	95
PID 5192 wrote to memory of 2256	5192	msedge.exe	94
PID 5192 wrote to memory of 2256	5192	msedge.exe	94
PID 5192 wrote to memory of 4984	5192	msedge.exe	95
PID 5192 wrote to memory of 4984	5192	msedge.exe	95
PID 5192 wrote to memory of 1304	5192	msedge.exe	96
PID 5192 wrote to memory of 5632	5192	msedge.exe	97
PID 5192 wrote to memory of 1304	5192	msedge.exe	96
PID 5192 wrote to memory of 1304	5192	msedge.exe	96
PID 5192 wrote to memory of 5632	5192	msedge.exe	97
PID 5192 wrote to memory of 5632	5192	msedge.exe	97
PID 5192 wrote to memory of 3248	5192	msedge.exe	98
PID 5192 wrote to memory of 3248	5192	msedge.exe	98
PID 5192 wrote to memory of 3248	5192	msedge.exe	98
PID 5192 wrote to memory of 3172	5192	msedge.exe	100
PID 5192 wrote to memory of 3172	5192	msedge.exe	100
PID 5192 wrote to memory of 3028	5192	msedge.exe	101
PID 5192 wrote to memory of 3028	5192	msedge.exe	101
PID 5192 wrote to memory of 4472	5192	msedge.exe	103
PID 5192 wrote to memory of 4840	5192	msedge.exe	106
PID 5192 wrote to memory of 4840	5192	msedge.exe	106
PID 5192 wrote to memory of 4840	5192	msedge.exe	106
PID 5192 wrote to memory of 3528	5192	msedge.exe	107
PID 5192 wrote to memory of 6004	5192	msedge.exe	108
PID 5192 wrote to memory of 6004	5192	msedge.exe	108
PID 5192 wrote to memory of 1240	5192	msedge.exe	109
PID 5192 wrote to memory of 1240	5192	msedge.exe	109
PID 5192 wrote to memory of 1240	5192	msedge.exe	109
PID 5192 wrote to memory of 4588	5192	msedge.exe	110
PID 5192 wrote to memory of 4588	5192	msedge.exe	110
PID 5192 wrote to memory of 5060	5192	msedge.exe	112
PID 5192 wrote to memory of 3376	5192	msedge.exe	113
PID 5192 wrote to memory of 2972	5192	msedge.exe	114
PID 5192 wrote to memory of 820	5192	msedge.exe	115
PID 5192 wrote to memory of 820	5192	msedge.exe	115
PID 5192 wrote to memory of 5552	5192	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd08d5c188,0x7ffd08d5c194,0x7ffd08d5c1a0
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,13605879302622623321,1816910902527132281,262144 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,5738421625358831537,15037334227976546136,524288 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,14839761713145479209,14081210068998466698,524288 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:13
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3668,i,5366754849059334280,9232638461693639104,2097152 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3672,i,17871126073083479244,3099883985455112200,2097152 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4364,i,17331597937333153675,13676222353159837749,2097152 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,14300508852301677727,17827463940706933517,2097152 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:9
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3908,i,15652942307839073997,4782310594496086343,2097152 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,11083392360041383897,18070524856743520507,524288 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,2804743944765808538,15111886089238378748,524288 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,2748419261626885201,2742663013284736746,524288 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,2748419261626885201,2742663013284736746,524288 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6764,i,3496546433747589918,11138414915486404902,2097152 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,18231195446541969205,6703000266449705321,524288 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:14
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,5167687347044952802,13541551697456417626,524288 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6952,i,6462496557335650828,10472164046650165432,2097152 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7556,i,3006316761407188315,17184952988275443318,524288 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:14
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4664,i,11169054089272778168,163863481697135459,524288 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,704316211437679522,3063572044182146582,524288 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,13813505232028992162,18193222102691833724,524288 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7236,i,16711893363634216508,14451184120639806932,524288 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6740,i,16840277499379590366,18212077337808854110,262144 --field-trial-handle=2584,i,11434278157011639837,15205718034788655156,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a8f8cda8307a0edbf538a0dd24e750782fe139c9f99b60fd4abd7d28ae3a314f
MD5 026f3fe55f2df0f7c299298660aeb14f
SHA1 f7afd395bf662ce51d07ef71962735d48aaefffe
SHA512 daad559ce359a279593364ae3b9d1bd76dfd6c07e07a4c1b51b8abdddd1538e32d98bc01b8bf45d9f0bb856c0e6b7cbafab99e64ccaa7c1102c5276fb9756e22
TLSH
T120516F9003E128E1EB548FF6A0EE69E736F0D439E6079E3BF5D822384936F046B41221
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e15d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e15d.TMP
Size 2KB
SHA256 1b0c51937f487062b73109392b58bc7586f7033c9a8a0d8555981ab690da0de7
MD5 82e72326c64a279393fb0c02c1546cea
SHA1 205b2c1078570320382904c3ba9398056680ed7d
SHA512 73d39e18c7b0747d29f28dc96ea393cebbbdb1e36938757089c6a1c5b3898938f50be77ae2eb9f9f9018c01c78dc6d59a52e25bb616eb799508b7d94942fff9d
TLSH
T18751409103A128E1EB549FF650EE69F736F0D879E2079E3BF5D812345936F04AB41262
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 db7bc0bb063e0175f8f7c9f538bd8f2476d983d59a3b8e188593e4501457db26
MD5 656d013bda16b95e4489d21223fee169
SHA1 4bad13c21515c19124a3d9f25bdebed03f5f6570
SHA512 eb08aede49d6d0c9b71aec4e3bdc79d27dda184a3005c9af1aa5185e0f05b2dc587ea799401b5d066c1b00d4ed82dc5f72436299d25823b7c161653a9b2d595b
SSDEEP 96:DMO+V0AHFEe5uVpamWPzwUoXETwrkSXUpwrup:DHY0A6eEVpamWPMUo0TwrkSXUp2+
TLSH
T1F1916AF7C3D8867E881156F0AB247E2BCD1D095A42283D5689E8EF4FA3E2471E14265F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d241ed8030f98c43973d738df24605611ea59d9e6134e967c1ad8a2d527d2e17
MD5 75bd933afd009ce659e8ffc827c64984
SHA1 827391b38a66ebe76a99ea16656ed48fc840a381
SHA512 eb914affe96687fdc5eb47958c3d479f2397550c654b7b89cc4f83c2963aabda08f172744842d0e75a4c5044086cf586eae791c10146dfd82e0d79897680eaba
SSDEEP 192:sxRUHaR+Ob/f8sCPkhA8/ItizoA8p4o/g6+WNIYZ7PKsBGOIgIJ:sxREa/b/f8sCMhlQtvx/5I69s
TLSH
T11C32B8166968993B9CCBE20DFB56BF53E2F95032A1D41E58ABFC870C04E7ADD120741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bac5286b1f9bc46ebdc01762a3d6e1b9acec4cd7953bf9951c32d6448ab16dc6
MD5 740f6cd6db7c887d565f5430b6e87756
SHA1 84cff1f6edc9deadfaf4134b1e9c9387acbff758
SHA512 f41c3390a67b2c2812cd9e73a692283837a7f955cbb2cd547434ad9446d5184ddc0856d1cc5634ac30030228f78c7ce452abeb66f5eb32ccd736ae8e1817571e
SSDEEP 192:sxRU2aR+Ob/f8ssBPkhA8/ItizoA8p4o/g6+WNIYZ7PKsBGOIgDLJ:sxRVa/b/f8ssBMhlQtvx/5I69R
TLSH
T19D32C9166968993B9CCBE20DFB56BF53E2F95032A1D41E58ABFC870C04E76DD120341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f8430d938d41142ae510c501e4c1f8eda7bc305bd48a919016ee255ff4e50375
MD5 de1cb3b8a9c2d73db20579f56f756236
SHA1 86bbd55e6ba4c2fb6d34d35edd21ee7d82d0cb69
SHA512 89611f7d7a81d7e32f950b01f81ab9d9aa0fed65dc3faf9535e7eb988b898f0e4153b5ebbcf1ef6bafeb325d5f0e6c18a67a0a3c459e67059c7032289c2a78f9
SSDEEP 192:sxRU2aR+Ob/f8ssBPkhAW/ItizoA8p4o/g6+WNIYZ7P0sBGOIgDdJ:sxRVa/b/f8ssBMhDQtvx/5Ii97
TLSH
T14942C8166968993B9CCBE20DFB56BF53E2F95032A1D41E48ABFC870C05E7ADD120341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 28d702f0663ec69e79986a459cef789ff4caae29fcb425bc3c4bff3ba807681d
MD5 95ba6f87b883e159eb3a21544ee3ba0d
SHA1 be8e5f45aa607a4c42f268d163a0db0624595895
SHA512 4ac3edcab69126f39887d7d4e3910969c23f77427141178b1388c7f4d165319b675882e86ad043512b47821d9b95eb2f40849c533069cf4daf69e09ea373f7de
SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR6hroOpR:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0V/
TLSH
T1F7B2DA2B604DCB7F9F801A9DAC196FD67D9802C797588D4047FE990C03C77EB922A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 65B
SHA256 26e78cb8e189406e12ca36d7fe0eee3d0757dcb21dd8c84917e09c50bff3b708
MD5 f012cdf7eed009b6531e662c6b34787d
SHA1 b0cf0127db406b6184aa1230ceaef87f6d0f7c01
SHA512 89ab98a58175d02e277f293cd9cd021d3dffd012d12bd15f4163b6a90216d6bc3fabeaf18fbefb17b9d007eb734624065a9ce52fa418ee5216d4250c588573f0
TLSH
T1ADA002B70911818B6F30A9D82135A21EF80FC3CC8CC0CEF4D049C0432128A334052491
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe598fb3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe598fb3.TMP
Size 149B
SHA256 2534769e42c8dfda28ce9778b4d9d31681cb4256489805d6e9af10524d52f5ff
MD5 7397ff408d652eabaace6e3a1f96f4fd
SHA1 892c72b9944e92916d606ab957b86a3166d48b1e
SHA512 6dc480c6780ae63f0cd3558675d16a9173830d7d86e1420853d0c1538584f60415755f9a2da4f22edf1d5471fb0ceeb0149c5683acd91245fd8166e6eafba400
TLSH
T16AC02B630A33494A7724E4C4E030014CA80BEFD89CC9C8F5CC06F0832078233C009020
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a6a44.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a6a44.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 049c4525f10fb611278830f69debf0efb69626238719eb393451cc6164cf2a6a
MD5 f8376a5e420c4796a61cebf15bcbaa76
SHA1 cd3ca66f1c5ece8eacdf1628ac4ab92e967178f9
SHA512 f3f766b2206c295b17bedb94487c6e12563d738547681dac5688e05f2211d8667384064f5432420045cbfa4ca5f20df58af6431e334927ba76066d1c7663bf4c
SSDEEP 768:0rv+4UNbdS324qiLRLv1Aam6aQMGdjWca4Ghf99N5:0bsbc3rvmaME6p9X
TLSH
T1D1F2BF32A86CD573ACB7A695F21B7643BEB0526385C80E84D9D96B0D02DB09E2307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 8b7d6f5182e66a359e4cd94ef92c9b203cb68b174fe076af65dfba1dadb9b9f2
MD5 ba9466ac08d58e1dd3139a3081afccdf
SHA1 7c4145596cfa861de605fbc30a55552cad3b0282
SHA512 ed7fed161f3950cecf93859e178216d7e754748d73fa10a22f0ab0036ec62422bd20f1256cac940a081471abcea52c64be6ebe68f5a109bd1cf2b1046a1b6a9f
SSDEEP 768:1j+943/4qiLRLvAAam6aQMGdjWca4Ghf992p:A943oKmaME6p9+
TLSH
T179D29E325C6899779CA69699F32B3787BEF0526384C81E84C9DD6F0D02D719E2307D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6a25340227b35741a97c34a8c5013a52060775721a48381a7a9c0deb523e9c02
MD5 5d30f5e90f1b9a8035bce8ac85722fb1
SHA1 941a52326ae97fe8631a0d043c6c6cd3d48c7197
SHA512 57fa678d320a06fdee1fe8cf49dd3fb0cc9513ef1c85b50119ab66a585eec1cf6953ad9e627f0e79317fecaf2c3dbed99574a147e995868a9a6f6d1baafd9b72
SSDEEP 768:8F1j+9p3WwgD4qiLRL/Aam6aQMGdjWca4Ghf992p:x9p3ZmaME6p9+
TLSH
T109E29E335C98C977ACA69BD5F71A3247AEF042A3C4C86E84D6DD6E0D02D719E2307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5093d4d5e47bf62d7911f982d946a71ec426a450cadfec957b4e9cc2bcb6a379
MD5 dbf45328dc78580102e510afae459af4
SHA1 5cbac2f09676ebf1849ea4c51413f9855b206557
SHA512 261a18568c534e26443c82261a5a4f34f8973a59048bf13c360da9e74e74d4849c785509865669f904682cf0ff76ddaca59425cafb7663939acf86fde5230b9b
SSDEEP 768:/rv+4UNbdq39IqiLjAAam6aQMGdjWca4GhfB/PeU/:/bsbc3sKmaME6pnH
TLSH
T151F2AE31A86C9573DDB79A99F21B6787BEF021A385D40E84C9D95B0D439708E3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 eebad2af591a165470dc53b9f40dfde3d8c34b5e7cd3a9ed987b5001d0060cba
MD5 5545950e6b9e123906af75d87a7fad3a
SHA1 1164aa4567a4b4c77825d5cfa22cfa0dad929e7d
SHA512 bb632fefb1659429a5b6fed94ffafe9fb8857245a29b27cf2a91d3c56ca3d085941f64b5968acea59a1751486dce77869c0eb59a22a08417812d400df335a4a3
SSDEEP 768:Gj+943k4qiLRLvAAam6aQMGdjWca4Ghf992p:V943hKmaME6p9+
TLSH
T1FED29E325C6899779CA696D9F32B3787BEF0526384C81E84C9DD6F0D02D719E2307D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

895db648-83dc-47ff-9515-9165ab2c4015.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\895db648-83dc-47ff-9515-9165ab2c4015.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download