b17b44de73abcac83f3ef0bfd81daa603aa2bd4a4fad4e2648996a67177d1f76

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 506B
Sample260723-wvnt3athnd
SHA256 b17b44de73abcac83f3ef0bfd81daa603aa2bd4a4fad4e2648996a67177d1f76
MD5 b65d60ee302af0714932f095de786492
SHA1 6f3588e48be7db658ab5118990d5839f3c92b09a
SHA512 cda08a21ff69962c1d3f288102662754a8898be7d32a9e467156ba5c2c56daaf4eebee97e103c879be6353fc37ef7fa04571cedf528d65d2879ea3e332a2be1a
TLSH
T1EDF09E9F91D2510E02726235BCC9F198ACC3680F579408C0F8D69549DF95912C1D30AF
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4896	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293040933453554"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{5E99208C-6243-46BD-990C-4DED7E19E1D0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 4220	4288	msedge.exe	89
PID 4288 wrote to memory of 2128	4288	msedge.exe	91
PID 4288 wrote to memory of 4896	4288	msedge.exe	92
PID 4288 wrote to memory of 2128	4288	msedge.exe	91
PID 4288 wrote to memory of 2128	4288	msedge.exe	91
PID 4288 wrote to memory of 2276	4288	msedge.exe	93
PID 4288 wrote to memory of 2276	4288	msedge.exe	93
PID 4288 wrote to memory of 3360	4288	msedge.exe	94
PID 4288 wrote to memory of 3360	4288	msedge.exe	94
PID 4288 wrote to memory of 3700	4288	msedge.exe	95
PID 4288 wrote to memory of 3360	4288	msedge.exe	94
PID 4288 wrote to memory of 3700	4288	msedge.exe	95
PID 4288 wrote to memory of 3700	4288	msedge.exe	95
PID 4288 wrote to memory of 4540	4288	msedge.exe	96
PID 4288 wrote to memory of 4540	4288	msedge.exe	96
PID 4288 wrote to memory of 4540	4288	msedge.exe	96
PID 4288 wrote to memory of 4124	4288	msedge.exe	97
PID 4288 wrote to memory of 4124	4288	msedge.exe	97
PID 4288 wrote to memory of 4124	4288	msedge.exe	97
PID 4288 wrote to memory of 1644	4288	msedge.exe	98
PID 4288 wrote to memory of 1644	4288	msedge.exe	98
PID 4288 wrote to memory of 1644	4288	msedge.exe	98
PID 4288 wrote to memory of 5084	4288	msedge.exe	99
PID 4288 wrote to memory of 5084	4288	msedge.exe	99
PID 4288 wrote to memory of 5784	4288	msedge.exe	100
PID 4288 wrote to memory of 5784	4288	msedge.exe	100
PID 4288 wrote to memory of 1944	4288	msedge.exe	101
PID 4288 wrote to memory of 2848	4288	msedge.exe	102
PID 4288 wrote to memory of 1944	4288	msedge.exe	101
PID 4288 wrote to memory of 2848	4288	msedge.exe	102
PID 4288 wrote to memory of 2848	4288	msedge.exe	102
PID 4288 wrote to memory of 3888	4288	msedge.exe	105
PID 4288 wrote to memory of 5964	4288	msedge.exe	106
PID 4288 wrote to memory of 3044	4288	msedge.exe	110
PID 4288 wrote to memory of 752	4288	msedge.exe	111
PID 4288 wrote to memory of 4656	4288	msedge.exe	112
PID 4288 wrote to memory of 5520	4288	msedge.exe	113
PID 4288 wrote to memory of 5520	4288	msedge.exe	113
PID 4288 wrote to memory of 2376	4288	msedge.exe	115
PID 4288 wrote to memory of 2376	4288	msedge.exe	115
PID 4288 wrote to memory of 2736	4288	msedge.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff8491ec188,0x7ff8491ec194,0x7ff8491ec1a0
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,13382200006141538699,16455534360203549367,262144 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,1243953876359219970,7698549445202502155,524288 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,13887696551809996490,1308989953296697590,524288 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:13
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,427930628049180553,11997714914472823154,2097152 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,14921962598582568402,387924767110661556,2097152 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,5124756482727045791,12418621931351813895,2097152 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,2554194965441475991,17979911527061712065,2097152 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3756,i,9894765840578773504,17914246033352900935,2097152 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,9410241847948968136,4605498451874895387,524288 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,14535020904307339977,6733357665100676644,524288 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,14137531884157925682,11973666617784386997,524288 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5996,i,11552924717319648088,1167784717833049773,2097152 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,3622847483626220849,3333627497499067735,524288 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,3622847483626220849,3333627497499067735,524288 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,15516168378281357149,16600889902484074103,524288 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,13219021343085464921,5315096186039210314,524288 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,16551478569937163786,1094141882628678355,524288 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,13821356494618995932,6128378302224487569,524288 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,9723367893947432304,1780831019491632474,524288 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:14
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,7616503658448221899,6187550454728074271,524288 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3736,i,7639117089557794374,9574394926825522479,262144 --field-trial-handle=2356,i,14133135840807096386,4172562127297351497,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fd56abb0-f703-457a-afde-e25ca2829bc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\fd56abb0-f703-457a-afde-e25ca2829bc6.tmp
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

5cb452bf-3765-482b-ae63-f98957c5cbf2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5cb452bf-3765-482b-ae63-f98957c5cbf2.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 52f3351fd5acb9d054f8507cf1298bdb432c79773de219daf878830da1a34c89
MD5 e91e544c86c9bae6d59fb60dfaca4393
SHA1 3bd7676e4252c83fa9abd2b0779c4e06368b3be8
SHA512 d85dc272d0b0e802896c09f21206b3cc0baf17c49ce7511ca3782f3463365ebcaa37fc75340d5336fb1bf706e11245c8d072375be2ca090f8340035a5a04db06
TLSH
T1EB613D18232EE9D3D7225BB100E1A9D43EF4C4B70A4F2FDDF0B8E175D82A7795152991
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599198.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599198.TMP
Size 3KB
SHA256 b389dedbdcba08e30d78c42c832e8fe0b58812f1cf2bde6a89339c27ab65ecf7
MD5 700daa9b1d7b3d77c59156553f06d929
SHA1 0516d61b123ec547a92a92fe4c997f6aaa864766
SHA512 aed7b972b7417e90c2c2592b5f0212507f2b165f794145ec5bbe2fa2ae7f6d3eeb2594e229a0132d3fe77490e46b3b0324ab74615f895c1d243e0f780bbb8164
TLSH
T106613C28232EE9D3D7225BB100E0A9D83EF4C4B70A4F2BDDF0B8E174D82A3795152991
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 75494d7d74a698bc6c71d61b2034b9bda3858c488630e3c064b0c08a9d1b4586
MD5 aac10fde8ba78ca9ab4fdc89df30fb6a
SHA1 872841e3f664eb669f3e4be268ab7e44850f57ef
SHA512 e90681b27b92ee5ab3f7b92b6192b0708a2a60bbf26c0eb2ce62872bdb7711970819ac5d89743058135e4728493bc01eb6e3513950a2d960332c1c0c07f8281b
TLSH
T17311BBB3C3E4866E990106F06A18AE1BCE1C0515831C7D6985D4EF1BC3E3465E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b7e12e31dba02cfe2c128764b99fdc82f66d4ed3d6633800a5f40a92b61b870a
MD5 63788dff6709e536f065ed2b88e4c97e
SHA1 f09b3998612e623ac9b8f9211fc7bbe0e87e54cd
SHA512 3b6b5df57e6e48d07d9a5e85c05cf60123783e6b828de635b61c380403b7e8aa378771d6cced900655c7e09e457e7a9ff68ddbc7fc7885a2cb57b53d019f2727
SSDEEP 192:sxRIRhyM/jK1Ml8UQ/O+/f+s7699smZiBzoA8peS/g6+WNIYxbJ5GrIgDZqJ:sxRIdqm+/f+s7s9s8J/5IEME
TLSH
T1C362B71696349977CCDBD20DFA46BF53D6F85572A2901E44AAFCDB0C00E66ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6c0f10240921a93abe88ee5ddfc27f20040c7fffd1fd8ddc9721bc57477ab524
MD5 b2dfa72a63f10733e8e2b2347396ae06
SHA1 5cd69bf167b06d7e440d5c90a98ed7bb3960e079
SHA512 1f381d448fec0a99c8774b7fc6e734fe6156b911e774c5c6aa503f4c50cc4d028f7218d39a3bbf5d96f8e73b2d16cc5372b5ccdd828a9b4b5d7620bf776f50a4
SSDEEP 192:sxRzRhyM/jK1Ml8wO+/f+sr69tsmZiBzoA8p4S/g6+WNIYxzJ5GrIgIJ:sxRzdI+/f+srsts8b/5IuMs
TLSH
T13152B71666349977CCDBD20DFA56BF53D6F81572A2901E44AAFCDA0C00E66ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 66990c8e1eb6dd5b94497f51e505a9230eebd364129c764c0655ef2c9560fe4d
MD5 f887f1741abcfd05775f0bf6399782c5
SHA1 ff9d7f7a5746c1a388c287216e7e968cafffe2f9
SHA512 1e243ee9bb40f4276afbdfddb913af445c919f878ca6d748406e38e2984b7d91642a8b3c59d13797cc7a6755132f7da3a7c552789b2f0eff6ac5ce83e45055b4
SSDEEP 192:sxRIRhyM/jK1Ml8wO+/f+s769tsmZiBzoA8p4S/g6+WNIYxzJ5GrIgDZYJ:sxRIdI+/f+s7sts8b/5IuM2
TLSH
T1FC52B816A6345977CCDBD20DFA45BF53D6F81572A2901E44AAFCDB0C00E66ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3836e684c9b757dbfe8fa0a6c96fd523b03c1101122373ab3dc3c394dc1db6f6
MD5 7090b4d932a36255fde4434dded40f14
SHA1 878b5077b89cb55d3893a177c1a59fa9e8e19c78
SHA512 3cacccae5abcd5dacfab142f300c37af2ad3f775d72237f63b76df2da4d2407494b2e93181d80e62ba75c7e5734edd1c6af4e9039bca622e9ef93bc51b9351b3
SSDEEP 768:0xCyAjWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OV9rVAOroJPemDp:0xCyAjWgbrfM1u1jacpAFJP7p
TLSH
T12EC2EC3B640CC77E4F844AADEC25AED77DD802CB97984D544BEA880C03C67EB521A5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e749554f1f5c1d563759ec708c0e6bd21de8eee4276827a243364a9fe1e30081
MD5 3c148722413d299392d7eb882cde0cae
SHA1 b7f3ea82057acbb27a91a207691581c333c385bb
SHA512 f017c77d0a4a919bdd59b73f50f7a8b2a3c307acc5d927cefbb9402f154564a035e062affa508e7ac7e56ff8376f008986063ef50c8832927dc37de668b64693
SSDEEP 96:KJVNVyVzVfV9VvV7VvWVzVAVmYV3VvKAV+YV5VvsVFVNVIVDVLVkCSUKDKs8AKZF:aPIVpPlVU5+lhjwY/mX/2RVq/UjXJ
TLSH
T160A119D2707B42017C7E291C96E9D527D6D2B0B23058A56F7FA800A50BA6E834EFCDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6e8b0be77a4f109958b7c284db424b53648b9c86cf012b1876b9f655764a780c
MD5 344f0aae687e31e2233105475a961b6b
SHA1 6d4e0416e40e7319a07625438ce892ef860b3e4c
SHA512 0a22f1a01e58d06608d8d2349aeb0fcf0b17e14dc6a382d75c198bb880613da862f5e8ac227a1f9b918c200b5478638bb157e2892d89e8d2047df7e05bc7703b
SSDEEP 768:xl3G9T6kKL237Ft57FzjF669yrqUjWiIwwxMtCYb9M6:xl3G9dXjF66INWZTMwYb+6
TLSH
T1B7F2BF75AC544AB3CDF2D785B2523786BEF081A3D3D80F8896DDA70D0A574ED134782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1bb85569d8bbc348f6e326c00e33c03d54bdb939919a16581e7d50fa234ca0db
MD5 a6942e00c9995036676513c9ee074478
SHA1 986a5ae004ff05dc96aaa56009bc5b375669dfc3
SHA512 82a830b4c6543a5334586cebc14d43b3659d5c63f6ec7100594c8654a23996add2c9a1c04b4deb1979f7f29ea7f73c15035e2c4174d66a0f946fe2be8f2c974e
SSDEEP 768:Pl3G6T6kKL237Ft57FzjF669yrqUjWiIwwxMtCYb9M6:Pl3G6dXjF66INWZTMwYb+6
TLSH
T157F2BE71AC544AB3C9F2D785B2523786BEF081A3D3DC0F8896DDA70D0A574ED234782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8ef56211d26e2cd36ee8b6adf6d9098d496cd365082c72203487e2ace4ff22fa
MD5 cdeae1b936afdf9b99e4cc182122a97d
SHA1 067e7ca6c4b63a92bb6f871ce19d70b5b051b8f1
SHA512 760061c67f1d7a85cf2b9d4166c0eedd14e7eb44fe06d75546f312d4c662a60d92d32e94a6820521d0c91da3c5de0c3452ad53eea3f37728b5aabcfbcd2abca2
SSDEEP 768:brv+4UNbdC3G9c6kKL237Ft57FzjF669yrqUjWiIwwxMtCYq:bbsbA3G96XjF66INWZTMwYq
TLSH
T12E03BF31AC585AB3CDF2D785B20337837FB0519396C80BD8DADD5B0D0A9B4DA234B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b75e86f72dfc9b6baf355e6b4a7699c835ac4b567585d3f51707b4d71262edfa
MD5 d3be63c3f7132d8421d9a5be7cb937b3
SHA1 818ae534b819e69df38f763ecc873752c71c4c01
SHA512 ed5aa7a91efd8a800889bec0d6800ac39790737a80b85427e66c07639728782aa885b0ffb1a0dc0e9797de1e76f1241816b4fb665f94c51f2d095e3ab8e6ecba
SSDEEP 768:WFQF3GwwgfT6kKL237Ft57FfnF669yrqUjWiIwwxMtCYb9M6:dF3Gsd7nF66INWZTMwYb+6
TLSH
T12B03BE72AC548AB7CDF6DB81B2563342AEF081A3D7D84A98E2DCDB0D06574ED1347C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 78c90bd15bff0f38938875bb8b8569fcd81c6c0f0479744780ba51bd777d845f
MD5 f2c710f3b705befac0c855b6bdf4f325
SHA1 f50e87efe18942190f63cdce8a9c5fa2e4a41421
SHA512 eeb0c572832250eaaff857dfa1568b54ba105bd70f232f6d894442b913d825f9b8acbbe1e6ff1acda33133b8cccd7ec08500c729f948d5ab2207e905d291944e
SSDEEP 768:arv+4UNbdl3lPkKL237FtOjF669yrqUjWiIwwxMRwUiler:absbX3C6jF66INWZTMSUsQ
TLSH
T13103CE35AC588AB7CDF2D28672433783BFB4509396C50B88CADD670D469B4DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

app.apk.crdownload

Path C:\Users\Admin\Downloads\app.apk.crdownload
Size 24.9MB
SHA256 bd09fe2c09c47c9b5de0b9164ab74925a65b18bc339c0548eb575859ecd3805b
MD5 25ad9548adff5f8fd9bb40c294f11958
SHA1 fba8239da76e0e7325290f68f783d39c7a389377
SHA512 40d2da60d717299c95bc1f87536f9212d0729992d92a32ddb0235b6ef9f9c9107034ab8766d9f4a6c49769b910d16ef1925c4177f0090e4eb01c81e6f3cdf52b
SSDEEP 786432:O0O5oSIok0Oy6TT/u/AFH+uGTbibXe/lsefgf:O0OqD0YTT/u/AFHpXei5f
TLSH
T151473346F754A81BD4F390B222A582760A091F4ED945EF095D8833F63CB3EF897935AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download