hxxps://external-content[.]duckduckgo[.]com/iu/?u=https%3A%2F%2Ftse1[.]mm[.]bing[.]net%2Fth%2Fid%2FOIP[.]XTqrX_kNG8AyR7UwEFPPJQHaEK%3Fpid%3DApi&f=1&ipt=5a01ffc8203ad196e39251d98164f5d2c9a2aaacea22ca0c4b17ff092126f941&ipo=images

Analysis

user interaction
yes
max time kernel
35s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Ftse1.mm.bing.net%2Fth%2Fid%2FOIP.XTqrX_kNG8AyR7UwEFPPJQHaEK%3Fpid%3DApi&f=1&ipt=5a01ffc8203ad196e39251d98164f5d2c9a2aaacea22ca0c4b17ff092126f941&ipo=images
Sample260728-we2e8aaf69

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1384	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297346638601740"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{84D4314E-BC62-4406-8876-D1FD77DE09AE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1832	2828	msedge.exe	85
PID 2828 wrote to memory of 2272	2828	msedge.exe	86
PID 2828 wrote to memory of 1384	2828	msedge.exe	87
PID 2828 wrote to memory of 2272	2828	msedge.exe	86
PID 2828 wrote to memory of 2272	2828	msedge.exe	86
PID 2828 wrote to memory of 4276	2828	msedge.exe	89
PID 2828 wrote to memory of 4276	2828	msedge.exe	89
PID 2828 wrote to memory of 940	2828	msedge.exe	90
PID 2828 wrote to memory of 1124	2828	msedge.exe	91
PID 2828 wrote to memory of 940	2828	msedge.exe	90
PID 2828 wrote to memory of 940	2828	msedge.exe	90
PID 2828 wrote to memory of 1124	2828	msedge.exe	91
PID 2828 wrote to memory of 1124	2828	msedge.exe	91
PID 2828 wrote to memory of 456	2828	msedge.exe	92
PID 2828 wrote to memory of 456	2828	msedge.exe	92
PID 2828 wrote to memory of 456	2828	msedge.exe	92
PID 2828 wrote to memory of 452	2828	msedge.exe	93
PID 2828 wrote to memory of 452	2828	msedge.exe	93
PID 2828 wrote to memory of 452	2828	msedge.exe	93
PID 2828 wrote to memory of 1044	2828	msedge.exe	98
PID 2828 wrote to memory of 2480	2828	msedge.exe	99
PID 2828 wrote to memory of 1044	2828	msedge.exe	98
PID 2828 wrote to memory of 2480	2828	msedge.exe	99
PID 2828 wrote to memory of 776	2828	msedge.exe	101
PID 2828 wrote to memory of 4920	2828	msedge.exe	106
PID 2828 wrote to memory of 4920	2828	msedge.exe	106
PID 2828 wrote to memory of 4920	2828	msedge.exe	106
PID 2828 wrote to memory of 3196	2828	msedge.exe	108
PID 2828 wrote to memory of 3196	2828	msedge.exe	108
PID 2828 wrote to memory of 3196	2828	msedge.exe	108
PID 2828 wrote to memory of 2340	2828	msedge.exe	114
PID 2828 wrote to memory of 2340	2828	msedge.exe	114
PID 2828 wrote to memory of 2340	2828	msedge.exe	114
PID 2828 wrote to memory of 5512	2828	msedge.exe	116
PID 2828 wrote to memory of 5512	2828	msedge.exe	116
PID 2828 wrote to memory of 5512	2828	msedge.exe	116
PID 2828 wrote to memory of 5732	2828	msedge.exe	120
PID 2828 wrote to memory of 5732	2828	msedge.exe	120
PID 2828 wrote to memory of 5732	2828	msedge.exe	120
PID 2828 wrote to memory of 5856	2828	msedge.exe	122
PID 2828 wrote to memory of 5856	2828	msedge.exe	122
PID 2828 wrote to memory of 5856	2828	msedge.exe	122
PID 2828 wrote to memory of 5912	2828	msedge.exe	123
PID 2828 wrote to memory of 5920	2828	msedge.exe	124
PID 2828 wrote to memory of 5928	2828	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Ftse1.mm.bing.net%2Fth%2Fid%2FOIP.XTqrX_kNG8AyR7UwEFPPJQHaEK%3Fpid%3DApi&f=1&ipt=5a01ffc8203ad196e39251d98164f5d2c9a2aaacea22ca0c4b17ff092126f941&ipo=images
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ffa9c43c188,0x7ffa9c43c194,0x7ffa9c43c1a0
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,10160737235465383569,15256972442569117909,262144 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,292451523443797479,8121468430736157596,524288 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,6747751353350827542,15021469111583694500,524288 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,2552020997073000451,1511095793092011348,2097152 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,4088140943644836064,4551090199507368546,2097152 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,5126927160494708104,1783867023617470119,2097152 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,12954799220563921283,16105450534110069778,2097152 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,7873025582382045220,6677084818398355170,524288 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,3705995475405503941,6021226845905578189,524288 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,13783205241363728662,6004569741965619706,524288 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,13783205241363728662,6004569741965619706,524288 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6228,i,14751758418463292494,5603140997009840151,2097152 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6512,i,1748299960887953927,7476557186459799213,2097152 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4276,i,14640709854067125811,2887444360816904177,2097152 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5932,i,4835178523308032581,5617214396448695294,2097152 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6840,i,7757728376212588156,7032625709863507480,2097152 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6848,i,14293052381888486430,12870119538019162981,2097152 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,7522344053122547071,17510418324060560306,524288 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,6642583415312706371,9237333453302487269,524288 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,51993479440348971,11915422279542739881,524288 --field-trial-handle=2332,i,3223194282660983450,6329348215600351720,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:5928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a
Size 37KB
SHA256 84186c94c202c6eaa8cdde14e8bcb82ae95f13413df2852b46bd013535425f4b
MD5 8abcb03d6ce0af82f0e2048c440e6cae
SHA1 b35be41ea1f9cf3fe270d01ce78b4b121f851ab0
SHA512 b6ea20bd67cd7fab5703a0e980ff2e338f195fb851cb6eb511c1e750e193d2887580fc998e5c7dad92839bf2ee6209498ac6f9a6aae81fa1f168784bc2085067
SSDEEP 768:frn6Vqe28sAmi/PwOzwOqHgPrzb0JW1bZwcP5TnHak8yIpxTkHDVChA28g:fOVidcwovb0JW1ySnBEHywhJ8g
TLSH
T1E703E173136772151FE5533BFA9B820D4208A78AC06F438D384965F96E7EDA9003FD68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 68KB
SHA256 47d91cd0bf170ab1972a0777e1051fe5ee2a840a1d9efbeb0097e338228a8888
MD5 2a1e87320b14aac1134938a0c0bade85
SHA1 3831900aec52ad0da761f20a4fa1069d6434a6fe
SHA512 000744a8dbbc14690245ac7924c7662544bee356b4973075f5e78726fe0848e6aa96b6cf327718217ede7cde98d7874a2a4c934d1c864203a6015df18fac2d68
SSDEEP 1536:6fWZ83jSNyAUf76Z+AGYguWv0KxwhneG/7Qe4rxzhRelJ1Z6EUR+r1:6eK3jS3X9GjuW8KxwhneG/0jJelJX6ET
TLSH
T18C63029CFFA35BB52865C41E9C69A33E48E3E296C97B9721133B01F502116C2E0F461F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 fece07fda16c6393115b735bf49e441395db9574aaed8710b5c9ca95825886c8
MD5 cdc1159750e1abc917d6c9fd42f559e9
SHA1 eba76ce302ee1259adc82696ec6bdb29892967e6
SHA512 a826d7244f38f17a974e866b0668a0f49ab6c091eb90ad273c3d49dc581abd954e3a542d72f50ef1e5c5a7ba477d4177eba53c86582d13f176f553d05f968b32
TLSH
T119D023E31180F076595C7EC140A5ECCFC72620644402EDE421E0585C093545DC507741
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58cb79.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58cb79.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 72d4a0655f4f13a92edd61092777bdcbd82437f5303661bdd744a07a993a2cc2
MD5 c8ef2bc839e02d49e7912e8835733600
SHA1 9c1fea11e971bb04826fc3584a69f4e945aec04c
SHA512 8874c5ce76d96ae32e2f8e17ea3664d331487c325115b4a6acdfdde4ff31f0e245b75c384ea542550292803e3db512191426e4ca7bc2abc86cf491486cd9938a
SSDEEP 192:sxZ+RRyM/jK1Ml8M0cB1T/fxsz95TodpT2IEHW6+WN9wHbH+1/Ywm+DwIgrJ:sxZ+Tsm1T/fxszfTI+Hb4g/s9
TLSH
T17652E816A63899F7CCDBD209B951BB57E6F54573D2940E44AAFCCA0C04E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8490455f0fcee020c2352c1f5e314b187f2082d62fe65fbbd0044d441f02b262
MD5 9b113b20ee09cf057c541582d2032d6f
SHA1 aa17118bef2b273240d5ce7c0720f7e525c519d5
SHA512 d8d3ce22d85ad1fec148e2d9a24e4cd455868588e8d6cdf03a033bc1613a9213d08ab45ff4f1979f4128e52b9e5463e8d5af2a29f6d0c3232f2d85d6e6c9d859
SSDEEP 768:xm4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dCrohJcbau1:xm4jeXmWvmKLEu1jacPLZQdZkT
TLSH
T1B5D2093B280CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c5e89f0308fd5eaadc14488fe8c35a1c89ebabc42789de9aaaf9de199bf2f6df
MD5 ee4e2d93c7d2d3cc187821610b443323
SHA1 69c4a07ccaa45531dcaa4efef3368b65bf4a6f6b
SHA512 23073bfbfed03a5bb16e4a6558957d1a7ff65b6d1a24fe7b612d5d4a275eef410f83228f74804f9f20ea79d6e3ea7ce6faeaf8a60174ab9ea720088d24e52bc8
SSDEEP 48:K4TINKEkY7yFTI1KQE4wrIRKkYMXy4CJuSk4/:K4TaKEkuOT2KQEPrGKkY+2
TLSH
T12B91534634BB02157D7D281D92A1C66B8B817AA77444E83F7BAD40A20E67E240CFDEDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c75d7c8cfc1ed22f27f8e1af3713cbd7529c472fa24e752703dbb38779b37f88
MD5 571b23a784e278decb678803dee60e99
SHA1 abf2b776f656ffcc79b7dcead626a2610c3c6583
SHA512 196e191c52b8f28ad2438f87a341191a69cc562c44c0ec9e159c453c76db98e82973bffc9207aa0f566c69d62305b1ff5e7aa8efefaaddfa8b5582632f3643a9
SSDEEP 384:TZcIhsNRWnLX3uf+uOdKc+2uKFqKlSn3fxZvpWH:LhrOjOAclu8qySnvxZvkH
TLSH
T1F4927C3318789CB69DA1A681F04736175FF49067E6C9AF84E1ECAB1E05DA5AC031FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cc3eaf49e8f914a797831f13a49320cef1240c148ef9745730142dd0876be32a
MD5 1e87e7aeb3fc1f561de44fa875e16d70
SHA1 915c51f244911665aa48d041bda75be64cfee1c0
SHA512 2e06f11f80971282ffdeba6e87c8f22337d6f50504c55da86137904b71379f19d2b54ad79d6c4bc3dd1e80e627987e5030ea01cb64a086fe1add8bfd7a0e25d6
SSDEEP 192:EONo6hZ0QmiUyvbpc/+jVQO1L75wOZIx1WU6:EONo6o4pu+uOdC2EWU6
TLSH
T1EA02E83568786CB78EE2AE45F48737279FE4117BE9916F84DAE85B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 033ca37fabfcf2fa37f798275aa0921edaca49aba5194f88d4fe715300e4c589
MD5 9d69cb1e32feec8e82151f20f66bfb9c
SHA1 401cfd47e791543c149b7136a6cb15384f0dd82d
SHA512 54c0438021bd2754384cd3d74680ebe5b5209f0740c6960c606b1514119aa0550897fb99ec36d8da8e3ef8b6107a852e15e60c7c683408232359f66c66b91d6c
SSDEEP 192:WONE6hZDQmiUyub6c/+jVQO1LKc+2BUj5cOqIqUU6:WONE6Zb6u+uOdKc+2ue9qU6
TLSH
T1AB120A366868AC774DE1A551F48732134EE45127EA86BFC5E5DC6F1C00CB6AC230FC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d680d33e2b55d4fe190bacb888548f6c8c386c2ceb00e5d02a2c7d7bc8c0587e
MD5 04ba7f90a714794650bc98b7c15259c8
SHA1 61f708b0252d2be9e540fb6aeca52e654685a9ee
SHA512 4b2baf3334fbc2c6cc3bde242a4adabcdafd5eea73468c6257d8fd29a692e9be1bfa82aaf69fa56ea3c26f04415fb593bc793a951c64a83205b9ec8a70e211f3
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58d452.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58d452.TMP
Size 392B
SHA256 ded4fe7a6dfc2b1dbdcc9a2089f713162300aae8d5233ad9f450d274b6b87195
MD5 febd850fabdbe6bb0ab8254548f50e15
SHA1 3d0d9b6f7b83f28b055129c0082ce74ed6709cc5
SHA512 f717c8e798f5856a6c46a117202a2a5f138478b5104a24a4eba2238cb241819d4103ae5d38d284c94701c76217796cd5ece489973a0ca7e7306a05a50ad945f0
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 844f1a7fb43299fc68f4fd87e4144927e35bfe227bf9a30bc2af3444135afeb2
MD5 bf0f882d95566716ab5cf0ee1fe9ff9e
SHA1 b8536cb515179f2f93eafa95746bd9f0cbfa612b
SHA512 c83e79c49ed0da5bbe83afb23223898581031fb127c3adf13ea177cb9d33832686e2332963831c3a87cc8ccfbe427401fb40608e8bfb5b3a14b14a60ca4fc62f
TLSH
T1D2412958B6FA1148B7B36E5A9FF7A96D447AB8732F07D45E00110D4E0A32B40D8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads