90946359accb469f75dab7df256a77ae8e0848606af4b751fb74602d72dfa090

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 13KB
Sample260723-w16l3asyd1
SHA256 90946359accb469f75dab7df256a77ae8e0848606af4b751fb74602d72dfa090
MD5 53cd700d66d4d5a639cc536d334e0315
SHA1 bcf25a20480fb82e62222ed2dfa843b5efb40300
SHA512 172427caceed3df63655d788ce3c4590bbd864647c206c2cae537a373365807428c3d29d796f7b338e170419479449e5b11adcf8f3a6c8d0697e9fb9901c88f6
SSDEEP 384:mDV7gVSBvXrGXp2aIRHd/i8XdYppiki2wHiq:KV7gVSD/HdbXawZfCq
TLSH
T17152E86A89E30026E01BC259BFFB210931359087930DE0553EDC4B4CCF98BAA9DA73DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
44	5440	msedge.exe
45	5440	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
39	raw.githubusercontent.com
40	raw.githubusercontent.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com
44	raw.githubusercontent.com
45	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5440	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293046715452634"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{1B535741-90AB-4A28-828B-28424FBDC505}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 3440	4448	msedge.exe	88
PID 4448 wrote to memory of 2972	4448	msedge.exe	89
PID 4448 wrote to memory of 5440	4448	msedge.exe	91
PID 4448 wrote to memory of 2972	4448	msedge.exe	89
PID 4448 wrote to memory of 2972	4448	msedge.exe	89
PID 4448 wrote to memory of 1344	4448	msedge.exe	92
PID 4448 wrote to memory of 1344	4448	msedge.exe	92
PID 4448 wrote to memory of 2700	4448	msedge.exe	93
PID 4448 wrote to memory of 2700	4448	msedge.exe	93
PID 4448 wrote to memory of 2700	4448	msedge.exe	93
PID 4448 wrote to memory of 1500	4448	msedge.exe	94
PID 4448 wrote to memory of 1500	4448	msedge.exe	94
PID 4448 wrote to memory of 1500	4448	msedge.exe	94
PID 4448 wrote to memory of 616	4448	msedge.exe	95
PID 4448 wrote to memory of 616	4448	msedge.exe	95
PID 4448 wrote to memory of 616	4448	msedge.exe	95
PID 4448 wrote to memory of 816	4448	msedge.exe	96
PID 4448 wrote to memory of 816	4448	msedge.exe	96
PID 4448 wrote to memory of 816	4448	msedge.exe	96
PID 4448 wrote to memory of 1108	4448	msedge.exe	98
PID 4448 wrote to memory of 1108	4448	msedge.exe	98
PID 4448 wrote to memory of 1108	4448	msedge.exe	98
PID 4448 wrote to memory of 5204	4448	msedge.exe	100
PID 4448 wrote to memory of 5204	4448	msedge.exe	100
PID 4448 wrote to memory of 3216	4448	msedge.exe	101
PID 4448 wrote to memory of 3216	4448	msedge.exe	101
PID 4448 wrote to memory of 3216	4448	msedge.exe	101
PID 4448 wrote to memory of 2648	4448	msedge.exe	102
PID 4448 wrote to memory of 2648	4448	msedge.exe	102
PID 4448 wrote to memory of 3396	4448	msedge.exe	103
PID 4448 wrote to memory of 3396	4448	msedge.exe	103
PID 4448 wrote to memory of 2012	4448	msedge.exe	105
PID 4448 wrote to memory of 5584	4448	msedge.exe	107
PID 4448 wrote to memory of 5868	4448	msedge.exe	110
PID 4448 wrote to memory of 5600	4448	msedge.exe	111
PID 4448 wrote to memory of 2136	4448	msedge.exe	112
PID 4448 wrote to memory of 1460	4448	msedge.exe	113
PID 4448 wrote to memory of 1460	4448	msedge.exe	113
PID 4448 wrote to memory of 4524	4448	msedge.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2f0,0x7ff8eb18c188,0x7ff8eb18c194,0x7ff8eb18c1a0
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,3659334919690610815,12660456031739389346,262144 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,5285858514336013704,17770885965680334239,524288 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,13527760471134456030,16923394418350601821,524288 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,13909356547656274065,9224254962992266632,2097152 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,8395431553410550854,1152014762470855097,2097152 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,4147295782459658297,4285924733613073190,2097152 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,635989724714375946,17339145986342296655,2097152 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:9
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3612,i,85484221655101984,2066032742962450246,2097152 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,4040654768017306025,8312767482576273587,524288 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5592,i,16443707134723631284,15782853494969993469,2097152 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,11553119577402082723,17123073903921765843,524288 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,9198581094634493738,4368251836073970319,524288 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,1413227299768343269,2528332246694406778,524288 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,13981021334366707955,4077364564234933932,524288 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,1413227299768343269,2528332246694406778,524288 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,1798451308085192317,16414799892856133250,524288 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,8213046409834996776,16411946721850896997,524288 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,6407190375793255826,2998326516638113432,524288 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,17796978682064368033,4457822437878825057,524288 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5352,i,9908181098155898468,6165309494380959523,262144 --field-trial-handle=2480,i,11426790248801151987,4693463662533856934,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

2f2714dd-9661-4a09-a5e1-f259fd0a08eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2f2714dd-9661-4a09-a5e1-f259fd0a08eb.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1ac74a5e5e414b17f02c3ca7c3c8e24ffa528e08230db76e0726ee7b607af4e0
MD5 a0bbcc1ba99bdcf76b16e68e81495ab9
SHA1 c9ecbbb2268d7cc3c8c2805407bac9d0529a0ed1
SHA512 f1de9a3bb9027fcb9371f4b5ad47296b3eec1c37eaa8224038f05e52ff2d87545b40dc45111bcab3abcf892d87276b10f2c1a73e952f7cf35ba1473380261d07
TLSH
T1E1612ED2A3A10AE2E7354EBF84E1F45737F4CC5A81B32E1474835E746462FE0A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590da2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590da2.TMP
Size 3KB
SHA256 4aa5c995500b22a0cfb278e235c8eff7e7dcdb8376a1749d389d783c4bafc92a
MD5 196f6a4c0af31d3ce5de67984f008aa9
SHA1 80ce9d9009e9213b83d00b38e2c53de39d63e5a2
SHA512 1b6fa38d5954f28f24863c75ef92247630441a1cb69ab93372c42df402e45cf8041e615b62a746d438a5e8ad21fd25a363a0677defbb1469bf4aa7df455606d1
TLSH
T1DE612ED2A3A10AE2E7354EBA84E1F45737F4CC5A81B31E0474835E746462FE0A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0ef927ce78cd0688bbf1b786273a11d745136306bfa6555a8c82f49a0aac2da7
MD5 f174a9a972d5b5c819fdac390cbd0a7d
SHA1 fcca14e4b3eada13cd43f0dba467799667b66fb4
SHA512 0694ec70a1d97ea3414f46b08d68b2ae039d9257ac4377c7bbe8114c90d671b52523b1d039296df8b6a01d97351d10afa5b3e665f0849b11b25355996de4cc39
TLSH
T158619EF783E4867E890156F0AA147E2BCE2D0516832C7C66C9F4AE1B93F2471E14179F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ccb628c692310c871ffda545c05d25d70f0c375f2e1b343f8c27736c014a03a1
MD5 82451e5a6d9b55e7bc93199e779abada
SHA1 83e0532fb9ebad61035b9e7f52d5f5668d5baa0e
SHA512 cf3a3003a17caf7001acbda6b4e5de0e09f362dcd6144a420649aac2693a155220153d5dda057618354c0ca61d7c9349fc25670bc618b3a44b8ce2a3fd326781
SSDEEP 192:sxRIRjyM/jK1Ml8wOO/fIsbZAprQ5dzoA8p4t/g6+WNIYn83hLG6IgDBJ:sxRI5IO/fIsbZA90/5ITR/X
TLSH
T1AC52C81666345D7B8CDBD20DFA55BF93D6F81563A2901E44AAFCCA0C00F6ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5f0ba494927afe61b1792ccae4a6dcc404e038429ea5a4d02f82a12e2d4cb5a5
MD5 bfcfc8128a0ffc7af133a0f56d151c3b
SHA1 75d8d0027bba6da5389315e03c23159d73910800
SHA512 c9143b1b46a623900becc7b62dd1be56ecdab8c4a37c983d2aeece3c1f6e997869c84238351acfeed789ff3b2a2f77ca64d3cc2ec6c3f029fc0555fd0928eda1
SSDEEP 192:sxRPRjyM/jK1Ml8wOO/fIs2ZAprQ5dzoA8p4t/g6+WNIYn83hLG6IgIJ:sxRP5IO/fIs2ZA90/5ITR/s
TLSH
T14452C81666345D7B8CDBD20DFA55BF93D6F81563A2901E44AAFCCA0C00F6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 63aec548c3c191699241cb6b5e1621086dd367554043417dd288583658e5277d
MD5 82e9efdbc71eef7b425aaccf288eaf0a
SHA1 7412af96abc08f339da6b45ccfc22bbb63aae0ea
SHA512 288f501dd8dc7c6f2c36512d351dca7aae9be2d5a56b48ab13700b96bc628501502a136bf105cbfc6217eaef6916c093cf900e1fbb23af6bd8373cfc9ccdbd48
SSDEEP 192:sxRIRjyM/jK1Ml8UQtOO/fIsbZLprQ5dzoA8pet/g6+WNIYn8KhLG6IgDXJ:sxRI5qYO/fIsbZL9G/5ITI/V
TLSH
T19A62C7166A249D778CDBD20DFA55BF93D6F85463A2901E44AAFCCB0C00F6ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e421a2a06232b546cf0f18bb1818643c9e42695746ef2bbbf95390f096d06ca1
MD5 8d1250d63cffa9fdba1bea9a214e3b48
SHA1 bbe6058c6edb01d733ff10336dee02e071b33067
SHA512 62113525d0fc18a81d1fde2bb8b5ff3a49cddb195ed9baf200b67e214d94ca03c9f83dfdbb920f3c78424b38d03539afc175ac8130db4077ea6e4c8d05d27b84
SSDEEP 768:wGedp6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIu4YrroSh8556:wGedp6WgoufDMu1jatVYYPw
TLSH
T185C20B3B640CCB7E4F844E9DEC29EED76DD801CB9A984D5447EA890C03C67EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a3cce3819bf32f91ad34d5a0b288f406ef415d3dad1c595892580c5e3e9d244d
MD5 ed56aa212736d52e59d35e9dcc1d0a40
SHA1 e0046ef78056dd173b2244c8b72d5dad3b0a01bc
SHA512 34b1358ec87858dedaa7145392ea180fdc4cebf6db63e6e677fd2f9838e1d1f0660b9238b916cc8c28eb0322b2d9e31ea028185aeff92d5581a5776d73c6a8e7
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHm7KmgIIOW4tVgGOK47g0OcOGlkvHcrnpS:CdqjXNn7Oj4XfV+gBkldQzLkHm7KmgIV
TLSH
T161915600717A42443C7EB72892B9885BC6C2B477315AA56B77AC11A60FEBE434DFCDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a677.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a677.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ff688edcd22df0d58692ac55cc59d23a625f9032572f19dfe2b4d2044b8f0a7f
MD5 5c3cefb6f1a25e26266337b71621a448
SHA1 6684f7036601520cadbe180c71831795bc9727b1
SHA512 36025eb710ab170c548901270d4ae52aeef05ed1c6f3f10ad072b880c541bbd9c944b7c5e82274adfc5eb82c067d0f1d3c8fffba38b445ab8b6f3268b55e18b5
SSDEEP 768:wrv+4UNbdL3jGDZIO00heaNzc4ReyIsPyh:wbsbN3Mrtc44bsKh
TLSH
T13103CE32AC389D73ACF69686F00735433EF8615B81D81A94D9EE6F4C069B5ED230B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b406b128f6db6728bc243e558302ba72913f2f0a1835ab67291899c296a0574c
MD5 956ad8565797195a32dd175b7acc0e05
SHA1 219af1227126801962e4af8c6bbb9ceff8e603bd
SHA512 3e6236df0c08152aecd2599c05924e1c88ed150ef4278e296c86f2794a1676cdbb62382cd548d36dcfc289f27888a0a67986d79d77ca752d1aec1e46fdde3faf
SSDEEP 384:uZcIs38Nu6Bq5X1GVJDZNfNoXOVSUUq3heiaETRzcoXfK86sfxEZxxsIj4lByhOg:Ms39GDZIO00heaNzc4ReyIsPyb9Mul
TLSH
T1DCF2C031AC248C77ECFA9652F14635527DF5922BC2D82E88D5EE9F0C099B5AC171B412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 d40a45d280cf31bfe61ee238baff0b5f0e6cbaafb12e0a896f55d77aa58f1b84
MD5 5dbacb1f7e6cdb13515db07a8a834fb0
SHA1 9117f4dcfa7c1422abd2137ad1ecb1f406a60564
SHA512 bf8e637fb6dc777abffbd0967ba8d05e534ef0676396cc8c172b1740eb08949abfdfd05cc9bfd29596b45be1dabcee42f787652df4b84cd85b7f3d16fd7015d5
SSDEEP 768:/FQE3NwgqGDZIO00heuNzc4ReyIsPyb9Mul:CE3pZtc44bsKb+w
TLSH
T1EC03BF339C64C97BFCFA9B91F54A3212BEF1916BC2E86994E6DD9E0C05575EC030B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3bcc7dbf9165c5a1d19ca487d1d03000f007cf3385568b6fc018d156e7ac70e9
MD5 715522ffe4cde63ba2a499947c144f84
SHA1 8ee5b8ef28865dde0dd5048058f2540cdd4ca1d4
SHA512 b0e2f4a864e45e5f24be60a0b8ef206431dc544dc2d207cf02b837d5eca55d4dce6e37d406fba580131cb0c60cc7c871454a53ccba036ab2c9d069089ff66a64
SSDEEP 384:VZcIs38NupBq5X1GVJDZNfNoXOVSUUq3heiaETRzcoXfK86sfxEZxxsIj4lByhOg:ts3kGDZIO00heaNzc4ReyIsPyb9Mul
TLSH
T137F2CF32AC248C77ECFA9652F14636527DF4922BC2E81E88D5EE9F0C099B5AC171B413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e1727d377c03d7d23fc1f9e1b4cfc36bdf8d9c7c1d543da59e6f83d7ad1372a0
MD5 e0dafd9b3c79ce98bedb533f27fd2462
SHA1 dd19c63ce3ba3ad89c47fdbcbcfffaf7077c55d2
SHA512 d11e81f726dfd0d114b36d530cd987441ea4004e031819636dbd727994bc31f2ba99940f8ff1d9dad25c67405cd8db8bd7c4d420476f6a8b605d9e87e0b796ea
SSDEEP 768:6rv+4UNbds3nwDZIO0tNzc4ReyIsXzeVH1S5D:6bsbS35tc44bsDEH1Y
TLSH
T14203DF32AC789977ACF69686B50B76533EF8911B82D81F94C5EE2F0C464B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download