2203a759231e83a5d9db1c0a6104fad00b436377625cdf88699c4cdd7e33ef45

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260730-pgq9pshc69
SHA256 2203a759231e83a5d9db1c0a6104fad00b436377625cdf88699c4cdd7e33ef45
MD5 7d9885ade069f9dc66e71d8722b27446
SHA1 4a6a0f6d99cde5371658c908a58fb19fef1ae86a
SHA512 d29902e3f7dec2bc30536ebea2cb5f8a48513181f0ebaef289940905de3cdaaf434c7af68995b1ba60e1319ac92d77641e321bb9bf6f994a320cdc7d13f86ed3
TLSH
T1585186F1BD0259527B90CFD33B2B05B4B85DA947AF80C97AD0245C6E3908477BA52B70
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3572	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298875266159080"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{192CD699-752E-4DF7-ADEC-BD16B1F4E79B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 1104	4076	msedge.exe	87
PID 4076 wrote to memory of 3572	4076	msedge.exe	88
PID 4076 wrote to memory of 1344	4076	msedge.exe	89
PID 4076 wrote to memory of 1344	4076	msedge.exe	89
PID 4076 wrote to memory of 1344	4076	msedge.exe	89
PID 4076 wrote to memory of 4160	4076	msedge.exe	90
PID 4076 wrote to memory of 4160	4076	msedge.exe	90
PID 4076 wrote to memory of 2600	4076	msedge.exe	92
PID 4076 wrote to memory of 2600	4076	msedge.exe	92
PID 4076 wrote to memory of 2600	4076	msedge.exe	92
PID 4076 wrote to memory of 436	4076	msedge.exe	93
PID 4076 wrote to memory of 436	4076	msedge.exe	93
PID 4076 wrote to memory of 436	4076	msedge.exe	93
PID 4076 wrote to memory of 1532	4076	msedge.exe	94
PID 4076 wrote to memory of 1784	4076	msedge.exe	95
PID 4076 wrote to memory of 1532	4076	msedge.exe	94
PID 4076 wrote to memory of 1532	4076	msedge.exe	94
PID 4076 wrote to memory of 1784	4076	msedge.exe	95
PID 4076 wrote to memory of 1784	4076	msedge.exe	95
PID 4076 wrote to memory of 2784	4076	msedge.exe	96
PID 4076 wrote to memory of 2784	4076	msedge.exe	96
PID 4076 wrote to memory of 2784	4076	msedge.exe	96
PID 4076 wrote to memory of 628	4076	msedge.exe	100
PID 4076 wrote to memory of 628	4076	msedge.exe	100
PID 4076 wrote to memory of 628	4076	msedge.exe	100
PID 4076 wrote to memory of 1448	4076	msedge.exe	101
PID 4076 wrote to memory of 1448	4076	msedge.exe	101
PID 4076 wrote to memory of 1448	4076	msedge.exe	101
PID 4076 wrote to memory of 2580	4076	msedge.exe	102
PID 4076 wrote to memory of 1992	4076	msedge.exe	103
PID 4076 wrote to memory of 2580	4076	msedge.exe	102
PID 4076 wrote to memory of 1992	4076	msedge.exe	103
PID 4076 wrote to memory of 5100	4076	msedge.exe	105
PID 4076 wrote to memory of 4576	4076	msedge.exe	106
PID 4076 wrote to memory of 4576	4076	msedge.exe	106
PID 4076 wrote to memory of 4576	4076	msedge.exe	106
PID 4076 wrote to memory of 2868	4076	msedge.exe	110
PID 4076 wrote to memory of 4392	4076	msedge.exe	111
PID 4076 wrote to memory of 2448	4076	msedge.exe	112
PID 4076 wrote to memory of 3196	4076	msedge.exe	113
PID 4076 wrote to memory of 3196	4076	msedge.exe	113
PID 4076 wrote to memory of 3196	4076	msedge.exe	113
PID 4076 wrote to memory of 740	4076	msedge.exe	116
PID 4076 wrote to memory of 740	4076	msedge.exe	116
PID 4076 wrote to memory of 2428	4076	msedge.exe	119
PID 4076 wrote to memory of 2428	4076	msedge.exe	119
PID 4076 wrote to memory of 2428	4076	msedge.exe	119
PID 4076 wrote to memory of 3692	4076	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbf556c188,0x7ffbf556c194,0x7ffbf556c1a0
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,3089779265275819251,10353367787535081592,524288 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,1372605117898123386,10618015833978315768,262144 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,18384342564461379454,16560747524595165500,524288 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,8118432726370501587,3959578941223546606,2097152 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,4715501627884700721,9997216896699997742,2097152 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,10484180693809351512,6435228617063876653,2097152 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,13081186622533431078,17900037451721105403,2097152 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3608,i,18333878576345581172,3309042192370689744,2097152 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4984,i,8702648087306856188,7376289138688574041,2097152 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3588,i,15520182274403931405,7030557868339131468,2097152 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,2694426518163264507,8072493089175984799,524288 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=1636 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,1874263670430363370,8397130680135752629,524288 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,14222420532941055460,11118461662445418113,524288 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,14222420532941055460,11118461662445418113,524288 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6288,i,9941569664298969092,16354768645679757225,2097152 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,2076416043807725977,8640474629318568780,524288 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,3122741819404217419,13045425953942708424,524288 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,7814860966019100072,9494113141445205898,524288 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=2916,i,15833488218139033871,11979386543300072874,2097152 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,11165171526014237303,14162636881963718108,524288 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=784,i,8171953609095910377,14327591338152098402,2097152 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6276,i,17794427257634588524,4309383919496866589,262144 --field-trial-handle=2260,i,7429485043297664445,408284001231197470,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 01379d487ec4549aec0c69013496c665411fa8d18d2b501c803d5e8738b3fcc7
MD5 92707607ffab023ea9efbb1887148f1c
SHA1 4832182a407fdeff8ff8ba96e67993760b8d54b9
SHA512 efab35a19528a848d66f4ac0ba6adccc29512a71a13d34d991945530074578d06433c1e431cb1ed69ebfd36c5857a83efffd7ea976e9f1aaaedf5b69e22dfa7d
TLSH
T16161F7008E4A4501FF211237D4D21314F87042B93A975EEA426E8BBF440EB62FD3FA0B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1e3bfbc00d4e15d85078687ed8abedf2596a0e14e6c814c2d0042450751d7a66
MD5 93dbf658263a68d91ba2489405f93a12
SHA1 0e4bc4a699c38355c6bf3f9f2ccc2f50ccdcdb4c
SHA512 22f0a68cc3a1cc5c8a28c87e5d177891d203eee63763a09c5d0122c2de47d22e735aa21bd490f07966869f556809d5790ad2643e00e9605351da629ff943aa2d
TLSH
T15511ADF7C3E5866E8A0156F06A28AE2BCE1D0501832C3C1ACAD4EF6B93F3075E10195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 06047f61d12bc43a8749a1f85a8daeb5702acaca63a271db6746c1c157f5bc4f
MD5 67c0cd3a8f49c1e0681e4fb1902789ab
SHA1 294d6cfdb161d008923f53150ac31dc8be387fbd
SHA512 84e39a85d8a33062ab5a3d7e9d3d3db2dae47d3fa580673d30c6c4cec1467654a1abca7dee0ce0c3f39083d0d867239aac5ac4bf5a07d6740010eb978b53f7bc
SSDEEP 192:sxZpRbkI/fgRsGxLYIdpd/NHW6+WNGYLzgl+CIgrJ:sxZpeI/fmsGxLp7HbGHZ9
TLSH
T18422C8166F3899778CC7D219BB15BF53E6FA5032E1905E58A6FC860C04E6ADE230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7a99932afb6f7a2573d8177cd4249eb1cc11b00027de2df11e60c2ee19708d53
MD5 b0bc5a2956f8eafe5c214c6d60b7ffb2
SHA1 5c4b1937f4b11b4b27b8d2cd2dbf0dbc65eef86a
SHA512 fdbd69d169e7a39e14969c6f8b441bd0d6b65f56c5c783dff066852e381c5ccad8b3dcae2c84968f9114e6e113e8ffada7d598be6f972d288d12fac5dcf9a2b4
SSDEEP 192:sxZpRbkI/fgRsn6xLYIdpd/NHW6+WNGYLzgl+CIg5wJ:sxZpeI/fmsn6xLp7HbGHZW
TLSH
T14922C8166F3899778CC7D219BB15BF53E6FA5032D2905E48A6FC860C04E6ACE230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c9d00cd871a56ec48050e1e5da12a8a73b349054494eff5430f6f0929ae074ba
MD5 22091442a0d327780e4f5259db0df706
SHA1 2f04e40816f231bc5064d6675234b87a1ff23bd5
SHA512 ce13accc614df667d2d8ff7483155b15e5a6754c50c79c05435638b565fbd8663474473c1aa71dd77619dae8eb88f887199c311d8c7ca9349f92a79bd78878d7
SSDEEP 192:sxZpRbkI/fgRsn6xxYIdpd/NHW6+WNGYLaQl+CIg5iJ:sxZpeI/fmsn6xxp7HbGuZU
TLSH
T1C422A7166F385D778CC6D209BA15BF53E6FA5032D1915E48A6FCC60C04E6ACE230741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c48fc1bab7c449b8646fcf14b97ad979c1b030bde86ce7e012f9aaf1e410dce0
MD5 9c11118a9a4bf4db3f0424c483b9dce3
SHA1 ab5bfc99cb9c17876139a4525350edc5c0d6642d
SHA512 d678f3e566e243b7600c3e65cc168d7a730a7ba0e8369da98e1e88e2747e36b777ff920e5a593c0b9c198a1575486504323ae5eace6e260091d07c8f33616664
SSDEEP 768:FEO6fP1Wvxz3j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkILlWwJvWroXCt:FEO6fP1Wvxz3ju1jaZILIsvtXCt
TLSH
T1D3C2E93B240DCB7E4F801A9DAC5A6F977E9802C7AB588D4047FE854C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 705fe0acbc9868d56ce0a0f19a7918d1b1696c196034ae23281377f03415b85e
MD5 883b8d56f30cd372e1788797e2254b3c
SHA1 d79cd752bc96214ade4accf43317ec4b8de31a77
SHA512 f860276576b337e809a8b07de957e9cc502caaca6c19994eb68c4e6a5b4adb868861e48e0a940311d695f861d25e7c430aee9414bdb815b2228901aaa05cf9fe
SSDEEP 96:KUAAKtePKSsKL6C6GQKTyWSs4KZ27ExAUyT:iiXPf7rq
TLSH
T16FC11413367603027D7E29089655D7279E4679A3302DA42B7FEE40B21EA6E204EFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 23ce35059b95cdf870e374ff4d91596dd4b8633c8240e12564e793e229ff4c25
MD5 8ec7743e0311901db17a7f44bd133e9b
SHA1 ff7c30da65f2f848ea99bc5662180f2515d096ff
SHA512 4d5928b29a66cca9851e44ae88c4d30d7debe50168e35d54c1bf9dbbc352673d2a7d44fd86d294c00a165dc033d02c07ea18506183e6347e93f0b3fed7f453f5
SSDEEP 192:uWLsNSUFQn7+3v43QmiU14c4oo4atb0UO2rh2Wv8EsFhLMMqUjU8:NsNSUFT8FXa95O0MWv/m2AU8
TLSH
T14F32F936AD289C771EE2A145B58736139FA5006BDA8A2F80D6DD5E0C01DF6AC234AD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 11c04aadad7e86fa8f1f99492e4f9d6d2f5be54c4d97072a2cfff379197a7fe6
MD5 cab9decd1c45e20a0e1ead93277c3d94
SHA1 1fd25106028b9af59decd8b3d27f2018948efd25
SHA512 37eba90342f27d575a1cde02212d5779dd39061161114e4dd28cb424ee52337a8da612172dcc77b428fa36ad8a145ec672a9930b9e84e14a59a059792264813a
SSDEEP 192:qONY6O7+3hQmiUy4p4rGttb0UO2rh26gGxuSU6:qONY61YGt95O0M8tU6
TLSH
T17702E8356D386CB75EF3AE45B68727235FA5112BE9952F40D6E81F0C00DB65C2346C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f948b78860ee78b831a96315cd8fb821c5dd6d42f11f3aab764b1ae9bec78d58
MD5 0b0149fd57f90f45dd981d2660ffa4de
SHA1 1063867585425ecb86a764deab22cfcee9644f5b
SHA512 aeb68f3566ce70bcaaaac686542fb2483616ef19eb58ec86405ceef02faa0b3a55d54379af5a0113128f2c07170fc899eddd896af9a8f3e29a7c5de172e63f9d
SSDEEP 384:FZcIRzsNSUsT8FXa95O0MWv/mhAOObjI9G6w7Jc:9hQq/OOv/SA29MJc
TLSH
T10E927E36AD389D735AA3A105B5C636134FF9503BD7D92F80D1DDAB0C05EBAAC130AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e6b27b7e921834fa3ba85ad5ca417280f3739069350256d914ab31883cedb774
MD5 ee83f58cef5c546f2b069d2c05e76b39
SHA1 e3027e0b0ec42b842cc5bc8b3b67220cef9412de
SHA512 e45ff30dc2c166da6005a93a5e28707cd930e16aef3b019aabb15537b7845dc1b1bf397f262d023f6663db6569a8d2a1bdb0696b1073c7976194a3ffad17f682
SSDEEP 384:BZcIhsNSUsT8FXa95O0MWv/m2AOObjI9G6w7Jc:JhQq/OOv/zA29MJc
TLSH
T128927D32AD385D775AA3E115B58635134FF9503BD7D92B80D1EDAB0C05EBAAC130AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b8db50777ff08a87cdfbada510bfe8fdc1918e8e63bd35442ec11d82a5a190c8
MD5 cbf1b874632138e73bedfb645bd5cb89
SHA1 f8a0fb14edcc3667ab6dd03064083e28df823f35
SHA512 a087900d4efdedf4b3a08175100099ea2c839ac1ddd804412ed0a279860ed16422691a1209597ca03952113e2487f69d920b448985e1e1022c85fe5f5fec403b
SSDEEP 192:aONw6O7+31QmiUy4p4rlttb0UO2rh2Wv8EsFYcNMqUjU6:aONw6dolt95O0MWv/mJAU6
TLSH
T1CA121A366968AC771EE3A545F58736134FA5012BEA8A3F80D5DC2E0C01EF6AC234AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5dbaba2-a9dc-45f8-989f-3f162395b346.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e5dbaba2-a9dc-45f8-989f-3f162395b346.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ab04f46aa1d916f4d71abb3ed6a613659b36ecf786d90e28fb1794845ac16b5c
MD5 d2b09b67f52f76683694c05761e2c887
SHA1 dad3c47d1f57b13a72fe1befa41e3a9d7f40aba2
SHA512 611773cef97a71d45e4b3d049503ebdffdd2368d5e70d008c0798e330a09f3fc1004bfcd1adfb0eea6f2e9af57e8d7c51d28d233f824dbc9ee16dbb958812525
TLSH
T182410958AAE91148F3B76F56ABF6A46E447EBD772F0AD45E10110E4E0623B40C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download