hxxps://www[.]google[.]com/aclk?sa=L&pf=1&ai=DChsSEwiow_ys_MeVAxUak1AGHdi8BxwYACICCAEQABoCZGc&co=1&ase=2&gclid=Cj0KCQjwsMLSBhD9ARIsAIpUTDoDD_AoFptBi7C6E0J3piCaTWu1zaSHzWEcfzR6hrPVgpLA5XVwLZcaAqOZEALw_wcB&cid=CAASuwHkaA_ylkTVUa5j7rItRUNQyp0qFHWk0K-QhqmpBxMDsc1OUjMdZ5_k_zLAz2QTjIwbqXkyzckSQSfX4a1BJ7GiVIpRU3VO5mU3SB8X-juGQpmXczepE2Ygfjqu9Gy3UfJyUYIgpe5CuPzq4iuZASLL_XciF7jdRNHGrLNpvlwBJJJeaTuNlo7s2ro6Cq-C316oxsMfgMaTsxb8A7abXnA2XInKptUgw8Zg-pRY07Rt1T36NReMTYyUQezF&cce=2&category=acrcp_v1_32&sig=AOD64_2eSpckhvxR2g2KwKNMSFd5-Hadyw&q&nis=4&adurl=hxxps://express-resource[.]dhl[.]com/account-request-be-en[.]html?utm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3D%26gclsrc%3Daw[.]ds%26%26cid%3Dpaid-search_pf1EY5%26gad_source%3D1%26gad_campaignid%3D22332684638%26gbraid%3D0AAAAADSUNF68f5SHdQYXg40uwbR1rswdt%26gclid%3DCj0KCQjwsMLSBhD9ARIsAIpUTDoDD_AoFptBi7C6E0J3piCaTWu1zaSHzWEcfzR6hrPVgpLA5XVwLZcaAqOZEALw_wcB&ved=2ahUKEwiW7Pas_MeVAxXxU0EAHdPDOqcQ0Qx6BAgXEAE

Analysis

user interaction
yes
max time kernel
66s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/aclk?sa=L&pf=1&ai=DChsSEwiow_ys_MeVAxUak1AGHdi8BxwYACICCAEQABoCZGc&co=1&ase=2&gclid=Cj0KCQjwsMLSBhD9ARIsAIpUTDoDD_AoFptBi7C6E0J3piCaTWu1zaSHzWEcfzR6hrPVgpLA5XVwLZcaAqOZEALw_wcB&cid=CAASuwHkaA_ylkTVUa5j7rItRUNQyp0qFHWk0K-QhqmpBxMDsc1OUjMdZ5_k_zLAz2QTjIwbqXkyzckSQSfX4a1BJ7GiVIpRU3VO5mU3SB8X-juGQpmXczepE2Ygfjqu9Gy3UfJyUYIgpe5CuPzq4iuZASLL_XciF7jdRNHGrLNpvlwBJJJeaTuNlo7s2ro6Cq-C316oxsMfgMaTsxb8A7abXnA2XInKptUgw8Zg-pRY07Rt1T36NReMTYyUQezF&cce=2&category=acrcp_v1_32&sig=AOD64_2eSpckhvxR2g2KwKNMSFd5-Hadyw&q&nis=4&adurl=https://express-resource.dhl.com/account-request-be-en.html?utm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3D%26gclsrc%3Daw.ds%26%26cid%3Dpaid-search_pf1EY5%26gad_source%3D1%26gad_campaignid%3D22332684638%26gbraid%3D0AAAAADSUNF68f5SHdQYXg40uwbR1rswdt%26gclid%3DCj0KCQjwsMLSBhD9ARIsAIpUTDoDD_AoFptBi7C6E0J3piCaTWu1zaSHzWEcfzR6hrPVgpLA5XVwLZcaAqOZEALw_wcB&ved=2ahUKEwiW7Pas_MeVAxXxU0EAHdPDOqcQ0Qx6BAgXEAE
Sample260720-hlhd2ahs2q

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1204	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290037697620402"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{BD9C939C-42E8-4B57-A3BC-C0CE80E11162}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 5040	4384	msedge.exe	84
PID 4384 wrote to memory of 1204	4384	msedge.exe	85
PID 4384 wrote to memory of 5028	4384	msedge.exe	86
PID 4384 wrote to memory of 5028	4384	msedge.exe	86
PID 4384 wrote to memory of 5028	4384	msedge.exe	86
PID 4384 wrote to memory of 3492	4384	msedge.exe	87
PID 4384 wrote to memory of 3492	4384	msedge.exe	87
PID 4384 wrote to memory of 1876	4384	msedge.exe	88
PID 4384 wrote to memory of 984	4384	msedge.exe	89
PID 4384 wrote to memory of 1876	4384	msedge.exe	88
PID 4384 wrote to memory of 1876	4384	msedge.exe	88
PID 4384 wrote to memory of 984	4384	msedge.exe	89
PID 4384 wrote to memory of 984	4384	msedge.exe	89
PID 4384 wrote to memory of 1804	4384	msedge.exe	91
PID 4384 wrote to memory of 2976	4384	msedge.exe	92
PID 4384 wrote to memory of 1804	4384	msedge.exe	91
PID 4384 wrote to memory of 1804	4384	msedge.exe	91
PID 4384 wrote to memory of 2976	4384	msedge.exe	92
PID 4384 wrote to memory of 2976	4384	msedge.exe	92
PID 4384 wrote to memory of 3804	4384	msedge.exe	96
PID 4384 wrote to memory of 1620	4384	msedge.exe	97
PID 4384 wrote to memory of 3804	4384	msedge.exe	96
PID 4384 wrote to memory of 1620	4384	msedge.exe	97
PID 4384 wrote to memory of 548	4384	msedge.exe	99
PID 4384 wrote to memory of 2436	4384	msedge.exe	105
PID 4384 wrote to memory of 2436	4384	msedge.exe	105
PID 4384 wrote to memory of 2436	4384	msedge.exe	105
PID 4384 wrote to memory of 4020	4384	msedge.exe	108
PID 4384 wrote to memory of 5080	4384	msedge.exe	109
PID 4384 wrote to memory of 5056	4384	msedge.exe	110
PID 4384 wrote to memory of 2348	4384	msedge.exe	111
PID 4384 wrote to memory of 2348	4384	msedge.exe	111
PID 4384 wrote to memory of 1996	4384	msedge.exe	114
PID 4384 wrote to memory of 1996	4384	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/aclk?sa=L&pf=1&ai=DChsSEwiow_ys_MeVAxUak1AGHdi8BxwYACICCAEQABoCZGc&co=1&ase=2&gclid=Cj0KCQjwsMLSBhD9ARIsAIpUTDoDD_AoFptBi7C6E0J3piCaTWu1zaSHzWEcfzR6hrPVgpLA5XVwLZcaAqOZEALw_wcB&cid=CAASuwHkaA_ylkTVUa5j7rItRUNQyp0qFHWk0K-QhqmpBxMDsc1OUjMdZ5_k_zLAz2QTjIwbqXkyzckSQSfX4a1BJ7GiVIpRU3VO5mU3SB8X-juGQpmXczepE2Ygfjqu9Gy3UfJyUYIgpe5CuPzq4iuZASLL_XciF7jdRNHGrLNpvlwBJJJeaTuNlo7s2ro6Cq-C316oxsMfgMaTsxb8A7abXnA2XInKptUgw8Zg-pRY07Rt1T36NReMTYyUQezF&cce=2&category=acrcp_v1_32&sig=AOD64_2eSpckhvxR2g2KwKNMSFd5-Hadyw&q&nis=4&adurl=https://express-resource.dhl.com/account-request-be-en.html?utm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3D%26gclsrc%3Daw.ds%26%26cid%3Dpaid-search_pf1EY5%26gad_source%3D1%26gad_campaignid%3D22332684638%26gbraid%3D0AAAAADSUNF68f5SHdQYXg40uwbR1rswdt%26gclid%3DCj0KCQjwsMLSBhD9ARIsAIpUTDoDD_AoFptBi7C6E0J3piCaTWu1zaSHzWEcfzR6hrPVgpLA5XVwLZcaAqOZEALw_wcB&ved=2ahUKEwiW7Pas_MeVAxXxU0EAHdPDOqcQ0Qx6BAgXEAE
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,18255193234090046240,7826451510118159961,524288 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,12695974007215123255,10587590723070740350,262144 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,15062126420662936242,17410923096745476322,524288 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,13441245672474920557,8349016925433338388,2097152 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,11479955870213262531,14104623850291608749,2097152 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,12438431027122075290,3598848402608528006,2097152 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,8579108252169038881,15737954695274711381,2097152 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,2099365032342495690,2210015915304949902,524288 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,10377360283598318333,16865484267204915808,524288 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,8830377214738555612,5284067634237910095,524288 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,8830377214738555612,5284067634237910095,524288 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4500,i,1412990058347274720,16718369353380879603,2097152 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,5137977962919118319,4059570735449919157,524288 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,14231966811573734205,13822835605554362481,524288 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,1604687636141670846,9285418043928690785,524288 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,12413717285006056840,4959032955027243554,524288 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,1174791491160904214,4804923209293387038,524288 --field-trial-handle=2264,i,11460614797257718767,1663058026256276549,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7da90461d0e3595a540a4b1ffb84407885b43bed0078111c44fb31c3d718216f
MD5 ad09a4a83b940c41e6498b65c86cd007
SHA1 5a8473143946f13a4db3a170d21fa9629cea9593
SHA512 1e375d806698a9d9a50737ab0c6892b16402bbbd0467e94048d157cc9c20a187089781f8eaba2769d41e1976879ca8e46058a7ee5e65f08cb40bdf5892cde9f3
TLSH
T17171B634551653DFF7E6027290C12355F6328DEAFE273D411F2379B45E01FA08169389
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 76b31fbde4226aff8a820f5e985c04ef616f782b4229737778d53889c0ab8411
MD5 e2a22ebee0004a12675db614ba294661
SHA1 7c49256b52ba4e7f3312732cd4abcd9f69e33405
SHA512 1eaf8c90d37393c75c9ee0839b3b1a8d1fa7f95b217108a29fb17ad966ab9b2b759946c0ab9316d1b63a203bfc896ce825f9585e2098fe5f2f2f403cdae1215c
TLSH
T1F5718130841693DBF7E202B290C12258B7728DEAFD273D412F2378B49A05FA4862B75C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5829f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5829f9.TMP
Size 3KB
SHA256 a9dd29672c95ca6b453c794bb4c41bc3179ad2d51de1e8e6ccb576f7cc88a8e3
MD5 d32c405838c1c5a5044743dd91daa820
SHA1 b42b2c7ef0730ca7899f7570a550597f215f05c3
SHA512 b65032913c329d862b2a39f61aab9704e0b8083d2dac709ca60482e9c69e1f052b1121b05cf46cfc640113c8a546b34311bcd0adcd3b9f465c83ae73afc6e092
TLSH
T1CB719335551653DFF7E702B294C12259F6328DEAFE273E412F2379B49A01FA08169398
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bcd5958c112ec5f70106fc3704168bdd6492efa724010c5f05b5582df8070213
MD5 81da5842141a0cf040b74817053b6b8b
SHA1 7cbbb211bbb70b01178b66a7cca01e144b8f69fd
SHA512 d866c228b2338205028c2a8333931336c8f54be52e87b1a6c17fc51e13ef72c9b4974ab62e109f83de8e91873d362ff9a11da1ecfacbadd9ab077e91f36084ff
SSDEEP 192:sxZ+RmyM/jK1Ml8Mkb/fLsOJlDnIdpqNsHW6+WNyJu/YIhmVxFIg5GJ:sxZ+YMb/fLsOJdohHbt/raE
TLSH
T14452E7166A389977CCDBD209FA55BB53D2F51472E6940E44AAFCCE0C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b746d50d2d5c849b2b21af65b28cb1b60cd7d3457385a47570813a45664abc50
MD5 a2ca153025ecf0b9c9945736f75d32b1
SHA1 14218c9f6dd20364f1208df90602c91443e836b7
SHA512 9c0865b47f6e27e908a65fbfac9ad955f3f192f0812a67b89a44ee0afa2f9d49850c3ad35f957bbc9c5b5ec3dafcce250f1c77f5fa95ffe6ee1f645995ac337c
SSDEEP 192:sxZ+RmyM/jK1Ml8Mkb/fLsiJMDLIdpJHW6+WNGYIwjxFIgrJ:sxZ+4Mb/fLsiJKUJHbGW9
TLSH
T1A142E7166B385977CCDBD209FA55BF53D6F80472E6900E44A9FCDA0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c68076496dd215e947291d440726325f3e638418292e50c73c7426485aa57622
MD5 b9d42686c4278164cc5c81ecb3fc9628
SHA1 fe96208d2f6df112e64346c295f7fb8c8470208f
SHA512 a3b6134545dec0c07b6112e8c841a0404aaa5194ce156227cbba144bf8e2fb179ebadee2ad7d8d93287af905028ce392169eb9bba36e7ab7d87b0b54018a304f
SSDEEP 768:82sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9Vro3LN:82sqxXlWvJD6Tu1ja54LAs9u3R
TLSH
T12ED21C3B694CC77E4F840E5DEC2AAFD76ED801CB96988D4447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7bac90de383090c0cc0895806823ae23950475dec7b137b4e485ceee001a99e9
MD5 58d244ab65e1b3aceaa944d8294d3def
SHA1 ae23a4c5adc530755e9627d44c0b79129fa30c60
SHA512 1e0bb9583c46dcfa9169924df22fb4dbd6e69fbb0cba2df1739b2920b3c4dd468cfccfa2b0db0d5fc7e41340fd2fee62f4a0c4592e409f66153aabe282c65634
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTy3JMdIdKegIvyNHIFKMko/:KYbaKYIKvdCKegCeHuKMkU
TLSH
T10291301A317A0212387D38A8B2669A3B5F413A63701CE46E3FB850664B67E114DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b608dde6ef752fc99dfed92ea9f9573f25adceed4cd65d800ac7aa952f4dd675
MD5 d9352418cd0233089298eab6c600a89e
SHA1 03649b5d0119c3292cd2171700f7e8e903c72ebe
SHA512 f7423a4990f1a1d5882e0ccbfe1ddfd980652f24e45984fb18c3ad8bdab18a02491d444eed7676bfe0538a9523240aa7babedb8ff95933b0decd5feafb49e70f
SSDEEP 192:uSLsNjHQyakRbFYQmiU19D5B4VRN5+Fd107ptpefPwoUfSRMqgLU8:BsNjHfbGT5uVRNmd2OYodSU8
TLSH
T1C23218365C786C7B5EE36545F84736135EB4413BAE892F84D6EC9F0C01EB6AC130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6da05da7f99997dba64070b6544d94ef6713b5e2accfe368e30de068f68e87d1
MD5 1e34b219b2d64c8e84e2d1adea4f1194
SHA1 66d1c49aebb4b812f7dd41bf59e97ceea7ee80e8
SHA512 60a765ac150b1f35104a66bbf96e75bc85784b245909903c4e1337ebf0fa27bffc9d146e9e231e01c41728a5321be8a4a1bc31b5290b358b18fe79c97848410f
SSDEEP 384:LtNn/s3n9SfsNjwfbGT5uVRNmd2OYodSOObjI9G6w7Pz:Lj+9U26HmRlS29MPz
TLSH
T1D6929C365C281D7B4EA35955F44B3A175FF4817BABC92E80E5ECAF0C01EB6AC430691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3f4ba8229da1ef852e0b62e60bb335ca6b695c5bd6599399261d583d4b981f59
MD5 29ff0fa0c159fb14c8b81bb00ef67a91
SHA1 436fad3e6ddab7c96503ce4276b0bdc67992b2a9
SHA512 bb2fd5ac67ff0d812697825fb802b9a4a29b10681fedc01370d1614742a8db524341e6dd3f3588ce6d377b26121b0ba1c22d05c9e9c42fa8047794fe0057acf9
SSDEEP 192:tON06JkRtQmiUyB6W+RN5+Fd107sh3eRHJU6:tON06Ur/W+RNmd28qJU6
TLSH
T1A602C935AC782CBB8EF26D0AB58B37135FA4117BBA952B84D6E85F0C01D765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e9d86764db7f54a77be48fce4ca585a9a978f2d62bee4b9b4f5c72ab4bb024cf
MD5 fe4ae2b835196418cbd8a27a366a1dbc
SHA1 439441317063eb55314e4dae86279958e510fc11
SHA512 85c98bf114113655f2ea9242745cf4180ca29abfd03ae183b3ac5301bdda2c94fc55ea2e22b909352e162542538e29c687b21c4f77070fe8bc0a7964b23911a8
SSDEEP 192:TONu6JkRxQmiUyj6k+RN5+Fd107ptpefPwoUMVcMqgLU6:TONu6UPjk+RNmd2OYouSU6
TLSH
T137120936A8782C7B5EE36845F48735135EB4513BEE893B8095EC5F0C01EB6AC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 faee703ba5aa42c6eb6efcb56b81dfeb7f03e0e05258f56156a34cabba3a639e
MD5 0fa820309a64c04e0a8a21938fd37126
SHA1 f55311abe165ddca83fde429578740d2c9098498
SHA512 48bce5887a4a232d50d0395767bf2cdac9c3a7c36fbc599a69edb15f2812dbedb9664c3f03024974ea9fbc10c005e8b942aec70ee0f9c1a5cfe3c63f9a2dbbd2
TLSH
T1E741275DB6EA1149B3B36E5A9BF7A9AD847FB8372E16C49D00010D4E0623B40CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads