8e48562dcad5818a462c37d2dc09f8bc7b0d29c41cedd121de6f54bfdfd84802

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 529B
Sample260728-ap8fmaeb48
SHA256 8e48562dcad5818a462c37d2dc09f8bc7b0d29c41cedd121de6f54bfdfd84802
MD5 61a1eafa16abe5cb7c385f91bc94a001
SHA1 6bc1e5104786eb787a003b74fab43ed1b7e9d546
SHA512 1713884e2248c7d6598dd257fb6c5ec028a8cfff45207d231cd07dcaf3e4c626e0dd474218092d2728fa9e3172d54efbb6a71b63bcea9cd23ce67c9d7d319b4e
TLSH
T189F005DF1C334B469251101809F9B35831E3315F3041C5A175F8E0A89FD0E539407BED
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
27	1732	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1732	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296719483730278"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{100264B4-1298-4072-9948-F41ECD0911E0}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 4556	1260	msedge.exe	90
PID 1260 wrote to memory of 1732	1260	msedge.exe	92
PID 1260 wrote to memory of 6048	1260	msedge.exe	93
PID 1260 wrote to memory of 6048	1260	msedge.exe	93
PID 1260 wrote to memory of 6048	1260	msedge.exe	93
PID 1260 wrote to memory of 6832	1260	msedge.exe	94
PID 1260 wrote to memory of 6832	1260	msedge.exe	94
PID 1260 wrote to memory of 4640	1260	msedge.exe	95
PID 1260 wrote to memory of 4640	1260	msedge.exe	95
PID 1260 wrote to memory of 4640	1260	msedge.exe	95
PID 1260 wrote to memory of 4932	1260	msedge.exe	96
PID 1260 wrote to memory of 4932	1260	msedge.exe	96
PID 1260 wrote to memory of 4932	1260	msedge.exe	96
PID 1260 wrote to memory of 1952	1260	msedge.exe	97
PID 1260 wrote to memory of 1952	1260	msedge.exe	97
PID 1260 wrote to memory of 1952	1260	msedge.exe	97
PID 1260 wrote to memory of 2280	1260	msedge.exe	98
PID 1260 wrote to memory of 5148	1260	msedge.exe	99
PID 1260 wrote to memory of 2280	1260	msedge.exe	98
PID 1260 wrote to memory of 5148	1260	msedge.exe	99
PID 1260 wrote to memory of 5148	1260	msedge.exe	99
PID 1260 wrote to memory of 6520	1260	msedge.exe	100
PID 1260 wrote to memory of 4492	1260	msedge.exe	101
PID 1260 wrote to memory of 4492	1260	msedge.exe	101
PID 1260 wrote to memory of 1300	1260	msedge.exe	102
PID 1260 wrote to memory of 6368	1260	msedge.exe	103
PID 1260 wrote to memory of 1300	1260	msedge.exe	102
PID 1260 wrote to memory of 6368	1260	msedge.exe	103
PID 1260 wrote to memory of 1528	1260	msedge.exe	104
PID 1260 wrote to memory of 1528	1260	msedge.exe	104
PID 1260 wrote to memory of 1528	1260	msedge.exe	104
PID 1260 wrote to memory of 4628	1260	msedge.exe	106
PID 1260 wrote to memory of 3620	1260	msedge.exe	110
PID 1260 wrote to memory of 4860	1260	msedge.exe	111
PID 1260 wrote to memory of 6516	1260	msedge.exe	112
PID 1260 wrote to memory of 464	1260	msedge.exe	113
PID 1260 wrote to memory of 464	1260	msedge.exe	113
PID 1260 wrote to memory of 4976	1260	msedge.exe	115
PID 1260 wrote to memory of 4976	1260	msedge.exe	115
PID 1260 wrote to memory of 3020	1260	msedge.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffe2298c188,0x7ffe2298c194,0x7ffe2298c1a0
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,6748853100568875291,10215589091101901907,524288 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,11512898375702311475,5070959843397361245,262144 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,3802771173239524554,11741676280534128707,524288 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:13
  2⤵
  PID:6832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,8481613285664571404,4903640442751822333,2097152 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,5251027232949279710,14781849884056682170,2097152 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4380,i,16755464882584994639,11945987529298992045,2097152 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,10731733733236058716,3297216852372211006,524288 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3656,i,3026168663021747071,12070020823329060251,2097152 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,193450662031033622,2986877104110342017,524288 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:6520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,8329275741519944177,10168792368704034419,524288 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,4255836922497285484,13086963528835797043,524288 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,9962858197686883201,15753130197136743633,524288 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:6368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6504,i,9371540413116790283,1093212599754925778,2097152 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,8381654600145441021,298664266278926736,524288 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:6456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,8381654600145441021,298664266278926736,524288 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,6064413429685068462,14362470809975918938,524288 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,5299409342516805835,3840784594054298910,524288 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,5431815389471713842,6852999797727049451,524288 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
  2⤵
  PID:6516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,2184347925189806842,14486114688955780819,524288 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,305619004813867150,10503760309945830916,524288 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7356,i,7251845511664837753,1992566557414258057,262144 --field-trial-handle=2644,i,7644659824089774628,8904040265876327065,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 1a503bfe6cb73dbcfbb70c044e28c1a390e14c84d533bebca46bc18ebdf0bc06
MD5 2ad8c17eb86d008d7ce6b7700bdd62f1
SHA1 090370ecba0d2f04e01201b43a84a5c664d063cc
SHA512 da4255c82ceb2b694d215053707a47ee88c9968779e1e192afa26d7c6eddbdc52ea98a5f4ac64f0b9cf751636879770a5f872b9bb611ccd511930b0010389e89
TLSH
T197F0F9A6C821BC3719FD1B1870584B47FB54132B3B41984B3B3D821C4FB063B868681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ff7bb9ebd0dbc3e91201f54b870b9d199945e8b69ac6326eadddb336678e7cd1
MD5 336849a4c9c4fb55ec4342b1e415c1d6
SHA1 65a33d553784d84ed6fafe741580040886d5d40c
SHA512 31762a0725bc5304d6b47603d00d9d229a9514875d6c827a4a6534a36ec7ba6bf9b354eaabb052896c349e89f8709e5fe96d8b8b9484591e9558eb8cab9d049c
TLSH
T13A617F7B43B227D0F712DCF304D1A499BAF084E1028B5E0AC4927E364946F9CA8D389F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bd815ca46e98184e5496974d90c765bf0ff607d60edd842158931c03a32aa772
MD5 ff3db266b0b2208534cb25911d0a7679
SHA1 47cca779a5033fd575b2b35d256b625e80d8caa9
SHA512 3c2c72d00dabf2cb09abda5fb2ad050451cae0fc9e8165183c47ef0457476cede74daab67c8016d7af23c3390c11a5ea33bc60fc6764ff51e08cde1632af72c5
TLSH
T1AD61807B43B217D0F712DCF345D0A499BAF089E1018B5E19C9927E3A4846F9CA4D389F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a908.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a908.TMP
Size 3KB
SHA256 4dd45caf2fc6fc753d19d9e4bd9d784bf6263b0f68cd4c2b3e06124b2034597d
MD5 37349f1a8901f810c60bdfc5a82c89ec
SHA1 035444616b4daa9a5023e349969306d74402cac3
SHA512 1edec800fab366c97ba633d00385bcf04e75cc259c835135ffb2944eb9608abcbbd021e6c3731e5bd50b287f00d49492ee70fbde9c2c184c1571e9a74a7b22be
TLSH
T1E661607B43B22BD0F716DCF345D1A499BAF484E101875E19C9927E3A4846F8CA8D389F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 45f39c390d495ef6f4b11e46ca0bfd181223a07fd1fba78e5d7d2d1083b3b162
MD5 70bc3bb289f3302dfea36618431b951c
SHA1 cbc1b08722740ae4afd4c10c9832b44d29477392
SHA512 082de16bf73f6ae0d1f94892adc11c5b1e597afe25d5084fdfe1dbf7e7d8a6d7aaa85a0f1879ff351a184985255dd8a7443df1da1bec493084a3b4d810db425b
SSDEEP 48:YALlgyDPN1O/Zi/ZmsJdaVCZsJSfo7gmgj6As/zEs/2F7/oEzs8V/IlsO/Xsc/CQ:D13O4zaVcaij6HzT2ZQQwtTlNky3wQ
TLSH
T14691BCF7C3E4867EC90151F0AA186E2BCE2D0964836C3C56C5E4AF5BA3F6571E142A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 00da628b6c5a52f35cd1db7de5c9b29e4f22eb8419c9e5d729d804114897b7df
MD5 a921f6952dbed1205b54a670457623b6
SHA1 5bae8b70a4683a0f4b218b7eae247fc59940d1d8
SHA512 b490852e0b9900efe62eb7b341497b1ff1804021398c5849d8395899a18a300d80c44390229e5bf0a65f352c2730a5d485450dad71bd7af14c76f66779363431
SSDEEP 192:sxRaR7yMqZjK1Ml8wOT/fHsDmNRZDezoD8peGw/g6+WNIYcC4MPsGQwGmIgD4DJ:sxRaAIT/fHsDmN/DiS/5IW4KsGQis1
TLSH
T1A262D91A69349D3B8CDBD219FA857F93D6FD1123A1505E44AAFC8B0C04E67ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 178d719e08242debe79971e19840349701a4367053527dedc927f93084cf30e3
MD5 221c1d963aa4d2474da6ae27bc579b24
SHA1 5adbec4175acfdba2ae9b0d1f93234b169d4e99e
SHA512 ad1b5908ba344fca4e12d092220878d1a9c76d98313dc6d053a6bc725aab10fcff53887eefbc73c6dfd6f4b449d9e37b787e59ce33d836f77bf9ba4db7152287
SSDEEP 192:sxRaR7yMqZjK1Ml8wOT/fHsd3NRZNezoD8peGw/g6+WNIYcC4CPsGQwGmIgjDJ:sxRawIT/fHsd3N/NiS/5IW4YsGQij1
TLSH
T17A62DA1A69349D3BCCDBD219FA557FA3D6FD1133A1905E44AAFC8A0C04E66ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 792cfc53056b7e20993b300cd2e3f0426686cfe25416569924390dad57055024
MD5 91eb18f0abd5266b2427b07ebcd6acf8
SHA1 6386a12c600ed3aade9904942d994749765129a0
SHA512 4cab33bf732a1ce1a7569d49d548ce704dbedb036120ad5cf38d6aae9c59094d79cdc91c51f16644ed5c8375eb35e74f0d073ede054c715c2c1a90801b5f6d7e
SSDEEP 192:sxRaR7yMqZjK1Ml8UQHOT/fHsDmNRZDezoD8peGw/g6+WNIYcC4MPsGQwGmIgD41:sxRaAquT/fHsDmN/DiS/5IW4KsGQis1
TLSH
T14372D91A69348D3B9CDBD219F6957F93D6FD1123A1505E44A6FC8B0C04E66ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a4d4b6d728dfc7c536d3d6bcb19fad00638687f76418bbc84d9bf210e4905258
MD5 6f39294cf14ca60e275cfa7cc5358dd1
SHA1 20656405029fa7fa9cb6192130afd97c5fbdfec0
SHA512 c22d3054358983bd8c5a7a39c9e261ba1ef2eb198577010a99472ce441058e643759d9b93918b82c166c1c587eb5437c044cca436c27dbfc7511dad19230e500
SSDEEP 768:Ob4YATWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBbDwzroT4z:Ob4YATWg1NfwBu1jasHwAUz
TLSH
T142C2EB2B244CCB7E4F844A9DAC29AED76DD801CB9B984D5447EB890C03C67FB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c73c8dcd081393ab44b5be20c0eeb7a6ee1c5997b05786a4647f0f3533557835
MD5 018c18c7b4d5cd23965b0f5b802665a2
SHA1 a22ad5f3fa6c480c827df74dfbb45749726c3520
SHA512 0ed2d4efb6dd2232312f7f473e8b743933d438056b8151ab97e4e01a09d7d592339577b7ede3207ddf01459a808b0550d43f9528067a602d88833550ffbb9a72
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EwtWSI+uxKbOq80B4jQozKONrUE:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRf
TLSH
T15FB25051713F4280387EB50C9178986FC6C2B4637519E52F7BA802A65F6BE039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 86692be0d117082ac013e5ccc1b5843950eb15bf34ceeea45b8d76243976522e
MD5 7fbc655b34d582b7458b88ab19726ff2
SHA1 0dcfd7fcf53d6b042a987064f6e8c884632d7bc3
SHA512 eccd0fbef762caae3c62528cccf898b65ff744481ef863330e368534f7c79ae4c56bc0b528fcf086ee2c8ef9bb8ab5d8a02c8208ccc22e58c62fbeadc13ae4d9
SSDEEP 384:nriFiZcIW8NLn8TUNTUlIRVePvuTnfpEqfbYGO5GMeCZrG+SOObjI9G6w7M8LEEK:GFQWQnwguursGO5deCxrS29MK
TLSH
T111D25C36EC64CAB7ECEB8FD5B6493A16DEE49163C59C5AC8E5C95E0C009B4ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3335948aeddca0f94c2b6bda7e8a15916e44d2c06db01a5adca82587cff43cb4
MD5 73dfb8d592f0df1c5c434ece0056e774
SHA1 2eb9133b06445cdba11e4c62cfa21e40f261beb3
SHA512 76b021f76330b1d3fa17632267dbd792096fe310b930dfe2f5d0f59ef10df35fe5c1dbf411cf7bfa87bbbee79154500c60af47849933fcf9226217387f0edd62
SSDEEP 384:nmiFiZcIW8NLn8TUNTUlIRVePvuTzfpEqfbYGO5GMeCZrG+SOObjI9G6w7M8LEEK:NFQWQnwguuPsGO5deCxrS29MK
TLSH
T15CD25C36D864CAB7ECEB8FD5B6097A16DEE49163C59C9AC8E5C95D0C00DB0ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1c862e9eaae55357c1ffd097663379edba33873b29e9c6d43e44b378049047b1
MD5 2d8235c6a3ca3c5692f29fdb8dbec97f
SHA1 6a327308a0d38c4294cafa4757f09b32a742dfa1
SHA512 6d61816cf991b01f793ab6d66ccaaf0549e3a4393590a1e59ed46222e656003266e481b180102c975bbbb1ed1f17763b80fc80f6cb083f43bcf75f7a31e2adcb
SSDEEP 384:nPiFiZcI98NLn8TUNTUlIRVePvuTzApEqfbYGO5GMeCZrQmSOObjI9G6w7M8LEEK:aFQ9QnwguuwsGO5deCxlS29MK
TLSH
T145F2B2F698D38AB6E8AE4B97633D2D169DFCD113B1985588B7C85D0CCC860BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 80b0134a7a93678df116caf711122cf0801d33c270588d4ab65e42d5c915828a
MD5 b2c3e475041cfa73947246665b0405bf
SHA1 70bf9b757f39f1c9a551dadabebbde9544a4963c
SHA512 86cfeb7aff6de17676cd3b8af8f1fa4c149ef828a01bf660e5440113acac25a5ec54a34c5f2b428f67da1f222af1a1780ebf9189b6c03d4066489d7e1af88e6c
SSDEEP 384:nkiF1tNn/s3n9Sn8NgN8TUNTUlIRiPvuTuaREqfbYGO5GMeILMOObjI9G6w7cd83:/F1j+9SXNwgUuPUGO5deWM29MH
TLSH
T1B4C25B36E855CEB7EDE64FD9B70A7A1AEEE05263859859C8EAC85E0C00C71ED0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bittrex-withdraw-portal-4.10.0-win.exe.crdownload

Path C:\Users\Admin\Downloads\bittrex-withdraw-portal-4.10.0-win.exe.crdownload
Size 726KB
SHA256 f5bdb2270f9dd1bf330e44acb7949d61eb5f3c5ecc87a92d6c387f8c24fcd61b
MD5 598742405a6f0d4a0e00226be8c22d10
SHA1 38f3af3c22634ac316aa09b8ae7ca69a4d819d57
SHA512 aac7212234b661a13a9f1242341a0049c1f9e5d69c6da480c5ba903a47bcdb837891a3611d6f3e9f9e19c789c29edadd517a4b02f6c971c251c5fc9540e71c67
SSDEEP 6144:fAEHbKyrVLKXt6BHztxtOHjn/3yl00f+xmi:/bvLKXt6nCn/3pJ
TLSH
T155F46B39E264B7E8E153957C89727901F6727C0A432196CB57917ADF2F332E0AE3A740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download