bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d

Analysis

max time kernel
299s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 7.9MB
Sample260720-a2mppacz3w
SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
MD5 0e3e4362f785aff0b9e1852b1064c0f1
SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
TLSH
T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289820336404741"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{BD0F3EB8-AFD6-4A3F-A7E3-74D80862FE8D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 64	2016	msedge.exe	84
PID 2016 wrote to memory of 3928	2016	msedge.exe	85
PID 2016 wrote to memory of 4792	2016	msedge.exe	86
PID 2016 wrote to memory of 3928	2016	msedge.exe	85
PID 2016 wrote to memory of 3928	2016	msedge.exe	85
PID 2016 wrote to memory of 2400	2016	msedge.exe	87
PID 2016 wrote to memory of 2400	2016	msedge.exe	87
PID 2016 wrote to memory of 3936	2016	msedge.exe	88
PID 2016 wrote to memory of 3936	2016	msedge.exe	88
PID 2016 wrote to memory of 3936	2016	msedge.exe	88
PID 2016 wrote to memory of 4836	2016	msedge.exe	89
PID 2016 wrote to memory of 4836	2016	msedge.exe	89
PID 2016 wrote to memory of 4836	2016	msedge.exe	89
PID 2016 wrote to memory of 1384	2016	msedge.exe	91
PID 2016 wrote to memory of 4584	2016	msedge.exe	92
PID 2016 wrote to memory of 1384	2016	msedge.exe	91
PID 2016 wrote to memory of 1384	2016	msedge.exe	91
PID 2016 wrote to memory of 4584	2016	msedge.exe	92
PID 2016 wrote to memory of 4584	2016	msedge.exe	92
PID 2016 wrote to memory of 2944	2016	msedge.exe	96
PID 2016 wrote to memory of 2980	2016	msedge.exe	97
PID 2016 wrote to memory of 2944	2016	msedge.exe	96
PID 2016 wrote to memory of 2980	2016	msedge.exe	97
PID 2016 wrote to memory of 2336	2016	msedge.exe	99
PID 2016 wrote to memory of 2484	2016	msedge.exe	108
PID 2016 wrote to memory of 2504	2016	msedge.exe	109
PID 2016 wrote to memory of 5348	2016	msedge.exe	110
PID 2016 wrote to memory of 6036	2016	msedge.exe	111
PID 2016 wrote to memory of 6036	2016	msedge.exe	111
PID 2016 wrote to memory of 5004	2016	msedge.exe	112
PID 2016 wrote to memory of 5004	2016	msedge.exe	112
PID 2016 wrote to memory of 5116	2016	msedge.exe	115
PID 2016 wrote to memory of 5156	2016	msedge.exe	116
PID 2016 wrote to memory of 5156	2016	msedge.exe	116
PID 2016 wrote to memory of 752	2016	msedge.exe	117
PID 2016 wrote to memory of 752	2016	msedge.exe	117
PID 2016 wrote to memory of 4364	2016	msedge.exe	118
PID 2016 wrote to memory of 4364	2016	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc5410c188,0x7ffc5410c194,0x7ffc5410c1a0
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,6542110233372929397,17801925128793192832,262144 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,17530246667367783037,12496212352434724133,524288 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,13717690032611798744,4235912366330851912,524288 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,7872895388091859397,5728599904701792882,2097152 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,8078079863198611243,2399403210978768537,2097152 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,14001649870109073501,13502295790704942874,2097152 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,16072942697854759971,17021912549083936796,2097152 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,15726212687468299508,4092386386190426086,524288 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,17359801185909864622,6698662183230717119,524288 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,12746683956886360292,9511149741207359449,524288 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,12746683956886360292,9511149741207359449,524288 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,2941292994269267615,14693893982218586292,524288 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,3806105088656071825,13452545751837184758,524288 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,17005826479077571512,8537697776948108210,524288 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,13549032407819911870,6125911359484231486,524288 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,4483858188615937630,2270148109059761358,524288 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5708,i,14038719121406759794,9662987137512315826,262144 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,17510566163687790624,561083759011080530,524288 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=1512 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,13789541052854067865,2086731233307376185,524288 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,638647581745437180,7911310162702055674,524288 --field-trial-handle=2300,i,136555582615113577,2949942995356596067,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 1b8ada84f6d076d596a512bce8e7ed72660b231073d2c5728556e82aa78f4b58
MD5 2d56e0dcd5eb372055ce3e62618220fb
SHA1 287aa598a2cb8ebd770264fc50d174819758b77c
SHA512 85b9e1a739322c97b5c2f14b7acfc010e18a3676cede2feec72a90d5187b9944a6fdc1ee8cdd25bf134d47169be35bc575abe6a0afee565e4c3f68867a265e99
TLSH
T1C7E020F445CDC37FE110E4474198670CD350B64ED2C479451705CD683046054E395971
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 69b34269dcbdba5794d1c7d07aa4714ffdc25cf52d48c06189a62e08f23c7c0d
MD5 b9f9210cb19371f21deddf2b76dca9a3
SHA1 b0cca858f5e43902116537fbfe29772505f7352a
SHA512 341a647ca732e619c7ca86fe277cdceae122929838547fd0fdd885f2e6c4ab463c7adb89cf1590c1f86d0ec8677dddf35bf854ab38d945106a4fde81bfcbeb8e
TLSH
T142E026A50ECEC22FD208F4474964674ED3A8360B92C8B90A5B0DA9A83606050E3B79B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f7a178e437353613143fd42a4a1aa41abaeb84c8070e572721965f4cf16acad6
MD5 c98985a761c1859aaf5123990688e902
SHA1 6e508b1481fef862b26cf8af9638375a44c8249e
SHA512 881e8d8648031bf66acac3235c8465297e894cd73ebcd1be8a3c40e86d7c140f0164b70386b10352c5d0992653e8cb4453192ebc07b0312f45396e87fd9cbc94
TLSH
T131514B7F42964497FB853C708FFD4E113379C64A2A6F5EAE00647A7E6711B3280D5039
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 1cbd7b771a407fcae361dd5fd1043904d26a628b0f690869f7bb6033b9d73d14
MD5 82670ffe9a0c3ef07326259f1e26d826
SHA1 7d8fa9b9dea00b183d5c7fbcbef8e237de99cdae
SHA512 66b22574e0226ffaf4aa64c421ff74b69bad0fe4b028347f8e9b5f1b93698641cba1c6bab507a5745c1d7b55100e7eae9e55e7805f315eed13d1bb9ed8d798fb
TLSH
T152117DB7C3D5896E891116F06A28EE1BCE1D0605831C7D5985D4FF2B93F3475D10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fafb8585571a4b526702703433befd796f83f2e03d3a2aeee3383af10b8303d5
MD5 e49f4dea8c79db6ade8483d9d130a2f5
SHA1 47ac4d75dc0cf9000c4fda07e0d5b07bef6c7f2c
SHA512 0e82dd0b36a49b42f01b0fc67743a4c4797e98a759b7422603e383499382da2cbb57e99073f941e1146a434c3b0000dbbdb37716a7b7a02ff81a06ec800ef2f8
SSDEEP 192:sxZXRIyM/jK1Ml8Mkd/ftsGg7zIdpdhHW6+WNGYHj+j5IgrJ:sxZXeMd/ftsGg7sHHbGh9
TLSH
T1C442D7126A345A77CCCBD20AFA557F53D6F90472A2900E44AAFCDA0C04E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f8f1b62d4628d49dc4bf29acbd452a3e0c035ff897c8a8aafc9ad0bd3b0f4ced
MD5 4632c7a437b0161f2e2b54dd17b38fdf
SHA1 13238b37affb5b26161716bd8a8c71c06aa8090d
SHA512 13b8e8ad341d04fc3755ce399b99f8a6b864919194e8394524ff0a23c4b20aff805dc7c73483d385be3369ef0ff56ad4e5ff07616d9ad9cf9a3372490e5c8b6c
SSDEEP 192:sxZXRIyM/jK1Ml8UQKrkd/ftsugAzIdpHhHW6+WNGYHt585Ig5oJ:sxZXeqDd/ftsugAsBHbGvi
TLSH
T1E252D7166A345E77DCDBD20ABA457F93D6F5047292900E44AAFCDA0C00E7AED6217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bb8170c18afbf6bc389c25ed77505e7a4ef315269d2824c48bfa04d010f9030e
MD5 7a26c9ea702f5ea3278a5f2af3c0ea9e
SHA1 e28bf47f444ed7b167d8c4477e930e1583fe9944
SHA512 b48eab28953956104faa58f6112053d675a762230dc2d663776b0b60c88f81dc839c6e19a0d21b5ed01899fe89b57077bbee9cc4e8d621798d84db557127a417
SSDEEP 768:KtUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RNroVT0Q:KtUZYTMWvg0Pou1ja7eLZmRmyQ
TLSH
T1BFD20B2B280CCB7E4F844E9DEC2A6F963DD801CB5A984D5447EA894C03CB7EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 49a1306e3ad574d247fca833b99bd3e908b3c5137891311daefe387f8b641002
MD5 a5b6379df699c4d5ce80a33244759a06
SHA1 bf427b42e2221667a5e2d929abcdd8aec5564cd2
SHA512 7de6ece8ec8a534d7d3031574db92f257172d0e7be1a1a8f7230b9c96bf5dc76a5c2df97f486b1ef8e8fa00f32fba69a3fc73b8c3f4d6b83774c09f9ebe9a516
SSDEEP 96:KA1eK2AEK0KTCqyuoKfq4NAKtyiiCAK7iP5w3j5HK:E2//3Pvw5w3j5HK
TLSH
T150D1224730B602923C7F2A0C86D597268E52B2633118E52F7BEC44B24E67E219DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37edea2c-c1d4-41f1-bc55-e834210be901.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\37edea2c-c1d4-41f1-bc55-e834210be901.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0a782459d17870d83bd0f7d083b06e4fde3ed50af9a260c2e3243da8783515b3
MD5 ed0712fab674d30e17c588807eb31b75
SHA1 acb82fa1f7129096ddb7d5b0137ac6839afe7761
SHA512 696627ab63a26c40035da458358bb298d9b83349b1c2290f1dda71a84350977fa4e2b94b0e8b747d97ade0a2ee6cab5ccb5d62c70fe2b745b95c8cd7ee3fca7a
SSDEEP 192:uYLsNOnfQytb76QmiU1NG54zX5Obd+jwODyRi7kySJrX4QrPqHQkoQ5:xsNOnfzGamzX5od+0ODn7ktJrJr4Qkoc
TLSH
T1E8422A3264785C775EA7A5C1F44B3253AEF840A7CA896F84D2EC2F1C01EB29C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 b4979e880b42a13d8c496b7ea45b451b834393856ff65c68c1a960fe86c5f898
MD5 2399f1bad13921d5fc0b6098cfd38dfe
SHA1 2e416e3bf9d07e32dfe58c3ddde6bcb51195221f
SHA512 8413bdb7aeee32708fb3492f6b1315bac48dad6a3ab3aa12130f6a584f6645510a72a0c018a211337466d448ff6d02e58648e13189f6c7cd595d8bc3fb8fe9e2
SSDEEP 384:FtNn/s3n9SfsNOBzGamzX5od+0ODn7ktJrJr4Qkoj:Fj+9UP6OFOn+hJ0s
TLSH
T1D6725B3265245D774DE3A9C5F84B3253AEF880A796C52F84C2EC6F0D00DB6AC131BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f2e2d05bf874d080b12f6473f32b9009c1f3eb9b864db82dc9ad7418cfc7a29e
MD5 7bd0e696438b1e37e1692f8d29d4bd31
SHA1 4ebad38dbf533ff288ca61807b22da34f4d1c1a7
SHA512 aafcdfb6028a6e42bb7439cb24d6104c8ba3561e01b6656f2919775b75e4c7f3ef46b48dd908f4ff9478b3be86914e806caedf50b3a2dac2518cca02404f58a3
SSDEEP 384:0iF1tNn/s3n9S7zsNe8TUNTUlIlBzGamzX5od+0ODn7ktJrxr4Qkoj:PF1j+9w7wg76OFOn+hx0s
TLSH
T1F192293359548D7B9EA69EC5F94B32539EF840A7C686AE94D3DC6F0D00DB29C030BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fab603905957b07b64b1a2612ee56dabbf2294c9e7ef3677cb2f148709d3fb7e
MD5 805c8d14beeb72ade2efbb9b2b23f064
SHA1 d7d9670bb0b40785c37aaef4e0b28a45458b5ef9
SHA512 9023613b82d52fc6de2732f9e8adeaf49683a64e3479528a8588b8a3f2afdcb5da36ae7f5c6afc4dcee2f6571ba813999d97903f2d4d68240f5a9b5a960699a8
SSDEEP 192:yON461VWQmiUyOegGX5Obd+jwODyRiV/arJ39qXU6:yON46W6gGX5od+0ODnYrPqXU6
TLSH
T13002E73669686C7B8EE3AE49B48737135FA4206BEA956F84D6E81F1C00D765C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8f01cb84197040e53a7294be62099b589af3685afe2ad0e87aca6b8335dfcb83
MD5 2be1db13c350c21c2f7ba1112b35bb78
SHA1 040e7200f70f8e2cb71006ccb0f08413266a76c9
SHA512 1eccea8737d7b920d259dbce76665ce0b27e1eae6c77ab652c1bc999df2b53a1540309a33d9090ad216751e09022cec8e947d4f018ef842be5c3ad9e2add1945
SSDEEP 192:uONP61PWQmiUyHeyGX5Obd+jwODyRi7kySJrbjJrPqHU6:uONP6QlyGX5od+0ODn7ktJrpr4U6
TLSH
T16D120A326568AC775EE3A984B48731535EE85167DA897FC1D2DC2F1C01DB69C230EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

834acc5e-1fdf-4579-a8e6-bad725b4be79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\834acc5e-1fdf-4579-a8e6-bad725b4be79.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 983f75883fe4950b208519d3a77705ad7c53f95f4be5617d88501b721482e1fc
MD5 8060f8c7ae701f9cd88547a42b05df76
SHA1 d7e1ecce84fc92af26ffb4947652fe3875ede44c
SHA512 f89c5dff69bfc409700ffaf083f9b0de3afeda66e807a1fdff85b5f49500244da0c767b936a4acf93fa46726761086d6b5a35787204d16f3bf13c464fbe0c0f3
TLSH
T1A841086CBAE91158B3766E4A9BF6B86E447FB9371E06D45D10010E4F0673B41C862737
MD5 SHA1 SHA512 TLSH

Submit Download