6cc5ce2375cb2f70373722d9dbf22cfdde352c40c8350151f02825ec31e1f8dd

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260730-pm1eka1ybt
SHA256 6cc5ce2375cb2f70373722d9dbf22cfdde352c40c8350151f02825ec31e1f8dd
MD5 bb8025ff82ee1ce95cc25956019379fe
SHA1 3e7e11f4227ec2a7f651c80ab6befdcf943282e3
SHA512 aba9385ca4d06b0463a2489ea88fb4284cfd9a347f46de1525aef2073c1eb4f96174cb2224f30de83b6c6499e9533f7a9a0f6572250fb3e5d378ffd31e4f1405
TLSH
T1A1519F907CE491DA339587DB3B3BC7F4F39EA909458208076F13DC9439345BAA8625B3
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2912	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298880627366352"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{ABF6FCA1-AD8D-4B61-B3B0-FEA6B4F3DB43}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 5928	1912	msedge.exe	88
PID 1912 wrote to memory of 2912	1912	msedge.exe	90
PID 1912 wrote to memory of 5512	1912	msedge.exe	92
PID 1912 wrote to memory of 5512	1912	msedge.exe	92
PID 1912 wrote to memory of 1372	1912	msedge.exe	94
PID 1912 wrote to memory of 5024	1912	msedge.exe	93
PID 1912 wrote to memory of 1372	1912	msedge.exe	94
PID 1912 wrote to memory of 1372	1912	msedge.exe	94
PID 1912 wrote to memory of 4212	1912	msedge.exe	91
PID 1912 wrote to memory of 5024	1912	msedge.exe	93
PID 1912 wrote to memory of 5024	1912	msedge.exe	93
PID 1912 wrote to memory of 4212	1912	msedge.exe	91
PID 1912 wrote to memory of 4212	1912	msedge.exe	91
PID 1912 wrote to memory of 4728	1912	msedge.exe	95
PID 1912 wrote to memory of 4728	1912	msedge.exe	95
PID 1912 wrote to memory of 4728	1912	msedge.exe	95
PID 1912 wrote to memory of 3840	1912	msedge.exe	96
PID 1912 wrote to memory of 3840	1912	msedge.exe	96
PID 1912 wrote to memory of 3840	1912	msedge.exe	96
PID 1912 wrote to memory of 2212	1912	msedge.exe	97
PID 1912 wrote to memory of 2212	1912	msedge.exe	97
PID 1912 wrote to memory of 2212	1912	msedge.exe	97
PID 1912 wrote to memory of 4944	1912	msedge.exe	99
PID 1912 wrote to memory of 4944	1912	msedge.exe	99
PID 1912 wrote to memory of 4944	1912	msedge.exe	99
PID 1912 wrote to memory of 5116	1912	msedge.exe	100
PID 1912 wrote to memory of 5116	1912	msedge.exe	100
PID 1912 wrote to memory of 5116	1912	msedge.exe	100
PID 1912 wrote to memory of 5700	1912	msedge.exe	101
PID 1912 wrote to memory of 5700	1912	msedge.exe	101
PID 1912 wrote to memory of 1400	1912	msedge.exe	102
PID 1912 wrote to memory of 1400	1912	msedge.exe	102
PID 1912 wrote to memory of 4744	1912	msedge.exe	104
PID 1912 wrote to memory of 2728	1912	msedge.exe	107
PID 1912 wrote to memory of 2728	1912	msedge.exe	107
PID 1912 wrote to memory of 2728	1912	msedge.exe	107
PID 1912 wrote to memory of 3484	1912	msedge.exe	109
PID 1912 wrote to memory of 1088	1912	msedge.exe	110
PID 1912 wrote to memory of 3460	1912	msedge.exe	111
PID 1912 wrote to memory of 1712	1912	msedge.exe	112
PID 1912 wrote to memory of 1712	1912	msedge.exe	112
PID 1912 wrote to memory of 1712	1912	msedge.exe	112
PID 1912 wrote to memory of 4376	1912	msedge.exe	113
PID 1912 wrote to memory of 4376	1912	msedge.exe	113
PID 1912 wrote to memory of 2888	1912	msedge.exe	115
PID 1912 wrote to memory of 2888	1912	msedge.exe	115
PID 1912 wrote to memory of 1508	1912	msedge.exe	116
PID 1912 wrote to memory of 1508	1912	msedge.exe	116
PID 1912 wrote to memory of 1508	1912	msedge.exe	116
PID 1912 wrote to memory of 2036	1912	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff82541c188,0x7ff82541c194,0x7ff82541c1a0
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,473077150342854409,12277018860866677822,524288 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,4244836794488906754,2261239579812110073,262144 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,13733168541905018455,8642280821166565585,524288 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:13
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,11729228682427424595,9460122288592530028,2097152 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,16988290133242661462,14105776817913141145,2097152 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=2744,i,8276345239650703643,13117133069236269257,2097152 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,17414984863879902349,8278299848859772023,2097152 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:9
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5256,i,17799541459875330559,10121976532122404605,2097152 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5404,i,5714654415640064991,7412088510216295014,2097152 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3628,i,1268555762387634901,1383020995353932898,2097152 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,9604193427081599030,8606287100381379355,524288 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,1547121680253779314,14273773355126361170,524288 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:14
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,14392563864736183276,1212217719199253104,524288 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,14392563864736183276,1212217719199253104,524288 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5528,i,4636595239474873485,499834289001410719,2097152 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,4397806630877407182,9980356892804255116,524288 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,2147364575818188976,14258229426587899521,524288 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,2468028421515792686,7182874417607413647,524288 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5652,i,9363688206970169428,15918812542127157221,2097152 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,17176750121437596033,4471082837439988118,524288 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,895159205264898233,1276337432570384826,524288 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6428,i,11468621923352034445,8895965585919573720,2097152 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5056,i,14818135509677509599,18004768182503416032,262144 --field-trial-handle=2204,i,3750094065763005886,2502005083742712440,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 de595627b2c85eebd55d31e4438aca8403eb0b48303e5855e70ed16f1262420b
MD5 9f0c5400c444f07dc58c2499eebf6a11
SHA1 2010ca14b33e1ae24a355b30191a2600e077f261
SHA512 6781ace91dcc2c3aa2e3c9a5992365a93d65d48860b5b417fefc9dd2e0e6af5fdc2e75548a89e4907ea35a68300dc2484a2d318fe44e2d190269f887bd48f528
TLSH
T12C41FC66CBF8B8DDD79248B210E0116A32F584D9051BEEA072F09EB34AD3F3491F8123
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 16200e779eac4f6a9b6701c0c0843737dbf5b55391bbc573ee6097b301bdf4e2
MD5 b0bd46a3c9a89b056a2be1300ecb83fd
SHA1 68c5f0fe507aaf764334852dc818000346f02309
SHA512 4bff4665b5cbb7e292b9ad23b9338ac4619e9bd6b659570c5a97f2494f34e15925be21f96d2843f3ad626e44d72e23cf443975ba4855d2fed2a728f41e0d4e97
TLSH
T13A41B0F3C7E4856D8A0156F4AB146E2BCE2D0915832C3C5AC9D4EF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2cf14f2067428b6de2c8836c0f2c8661e67e5150770fa175696d58a7cacf1af4
MD5 b3e7f43e896a4ca2f62e4c3e0c2aa380
SHA1 ed7dc73e69ec7415597f8921a08918d4325ff7f7
SHA512 38380f498fed01d3d27f854cb9ec05cd62c5b7d077a7dc91f71e86914ce95c213584ad5397d7d69c109fc7d36bb10ae0cadde8f773bfbe206b8e971b92c40eab
SSDEEP 192:sxRCVRSbv1/foslLIq3AtizoA8p45D/g6+WNIYZFL3SGsyYTIgDoJ:sxRCVat/fosVIqQ4/5IS+yYrY
TLSH
T12142A7166A289D3B9CCBD219BB55BF53E2F95032E1915E48B6FC8B0C04E77DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a1f886f5ba34f669a421a8aaa15f5ab8e980febe589fb7ab6793e03137332151
MD5 7a08b30c73726d29ce372ca2a5dd0371
SHA1 ef685665f7d5b09357d0b1d19a1c63668207d4bf
SHA512 4689e800361ad1d92287d320af65df1f1e173b7620594bf360dd51d57d92dff0ca3b05654a1771379be735dd9a48aff5b5c9f5ccfd3e110666fc43ba305ce83b
SSDEEP 192:sxRCiRSbv1/fosxLIz3AtizoA8p45D/g6+WNIYZFLKSGsyYTIgIJ:sxRCiat/fosZIzQ4/5ISfyYrs
TLSH
T1B23297166A28993B8CC7D21DBB55BF53D6F95032A1915E48B6FC8B0C04EB7DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ce636c2e12059279a9eaf3db5ff27b27e63d6bdc06414870d0f0ff46883d3edb
MD5 3a38535ea4c5bbd3396b00cec8c98c35
SHA1 cf66b6542e43375427f7f01b04c101d624659086
SHA512 1a779f7fb8224e301f3cdb045d867ceaf6bab33b3abcefb796ecf604e6375a246cb0d33a6b209a6a4aef144e7e68d1063aa1c60f2260311519ca65f86c81f701
SSDEEP 192:sxRCVRSbv1/foslLIz3AtizoA8p45D/g6+WNIYZFLKSGsyYTIgDyJ:sxRCVat/fosVIzQ4/5ISfyYra
TLSH
T1F142A7166A289D3B4CCBD219BB55BF53D6F95032A1915E48B6FC8B0C04EB7DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 87cd688c8534a54d3f255babf2109b8fb8d1214cf16a3f0f010eabd109ae954e
MD5 487edbf43b85d00c103c5474e604672a
SHA1 bb730aad648df24d2e7e44faf501fa1cc51c53a3
SHA512 f08a292af1635311792692f11e3ea70210643a34223c1cdb4e5e34da2d3c0201d6bb9459b1828cc5914062250dfa7736521be074154d5f31e53dc656b8b531fe
SSDEEP 384:KAX0EdqfCtgNbFfVNKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVui9LZRGProcmv:K80EdwWgNhfVN8F1+UoAYDCx9Tuqh0VI
TLSH
T111B2CA3B640DCB7E5F800AADAC196FD77DA802C796988D4047FE994C02C77EA91294DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e5f38d1819fe94ee862d4a2b4ead121b5ae5f05160d23948f2a72a14f382618d
MD5 d8b507e6d669126c30873e7ff28164d9
SHA1 b2e3d49db5fc546aaca9e1df3d241a76e162dd3b
SHA512 59f574c688f99771448916041639f0c95d31b79be45a5c0923c3131a5d0a79bbe8e07c56efcfda253a74a433e2fab46bed799a676ffe0bc2e597ce4147adcb89
SSDEEP 96:KRT8ZNbRRtWFKAg1tK4MgbtcjbylxWH+zC+4AwmWgFNg+mK4jg8mc2edsB24KbSL:CT8ZNbRRIFKR1nMgbCjbylxWH+zC+4Ap
TLSH
T1CF91DD91707A0244383D7A1895A5CC6ED7D2B4E33029E56B7BE901B60F67E024FFC8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

693c100a-790d-4d5b-b3b9-bd4b33987628.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\693c100a-790d-4d5b-b3b9-bd4b33987628.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 675e01c98f27bde44788d9313e57686f87ae9e5a206eedea71fee4f7e7b23442
MD5 4af7197253d60f9899b83e790a305267
SHA1 49278cc42358c5e3524c229bd8f66af5d259f468
SHA512 42c67ca110fff697dab58a0e254a569ad18e0dcd2ed1cd3225006336f10dc5188098c5bcd9306028ab5212f13a545f2f141e546a4f6dabf0995c6ba426da6bad
SSDEEP 768:Wrv+4UNbdN3lYUWZ+LeSFOUkdXX4fouOToPvB2thtA9VAgDb9Mk:Wbsb33lYRsnnwthttOb+k
TLSH
T10E13C032B8688D73DDA6D2A8720F75573FF0915386C00B88A9DE6F4D065BAED470BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5f0f19ae6b36f8724d58e7b73226d8a123565942bb32262fe9b30d4788cae03d
MD5 6aa2c362c1ee70abeea6612f8930f1b9
SHA1 6ffb19015310da317e6afe6c300978092c45538a
SHA512 e973a011b926abb2fdc5fa72b3f390d3c7751e6487c8380ad081561436a85cb2d030b5aabecd0e0934785ba1461bdf6fbecd411ce388942744ce21302a98ac59
SSDEEP 768:qa3lqUWZ+LeSFOUkdXX4fouOToPvB2thtA9VAgDb9MY:qa3lqRsnnwthttOb+Y
TLSH
T194F2C072AC648D73DD95D364720E36565FF0C123D6D40F88AADDAF0D0A57AAD070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0b4e57521980b9ac6127e3ef29f470471cefdf6de7182bc11bb81d1da880a060
MD5 4f87a4cac1477d841eeade099dbe1d0d
SHA1 965897ca67f880800edb9c0aed30dd9f2ccd7296
SHA512 937e9da55f925ae3a6494ffcdc26d2531c229437534f687679551b44f1e80581567ee321a1c08eb7242be85962c5388d791ca878de312eb8a345c7d8b80b05f3
SSDEEP 768:grv+4UNbdH311+LeSFOUWX4fouOToPvB2thtA9VAwPeVH1SlX:gbsbh3lsnnwthtt6EH1Y
TLSH
T1CC03CF32A8A88933EDE6D398720BB5572FF4816396900BC4DADD1F4D079B9DD070BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 9b34338e784f4d52da46d50e78be047d145ff1eacaaeae4b2dbe6b05a8f74a12
MD5 664fea5cbb7bdba9e3a4ae5158ec484b
SHA1 42b63075e8e1eeb2c3be1843f7cce144a5998051
SHA512 23f4b8757659b8f7e80a528912b01c819d50d33954e43fe12bb64e2db24999cfde1a7b921861f6a81bc22a83c912bc12897b114b5951d3089978beb87b56cd4a
SSDEEP 768:xFQa3PwgMqUWZ+LeSFOUkdGX4fouOToPvB2thtA9VAgDb9MY:Aa3GqSsnnwthttOb+Y
TLSH
T14403CF739C988D37EDAAD794B20E32565FF08163C6D09B94AADD9F0C06576EC030BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fbe27d53-fbb6-46ca-97d0-d9eb7917bcae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fbe27d53-fbb6-46ca-97d0-d9eb7917bcae.tmp
Size 35KB
SHA256 eea4a166378a6c6fb4ab988c7fedabd5798475bc501ba48361e5c71d84c60bb8
MD5 a1fc457867758c6f12fe35bf9e9150e3
SHA1 1be44dc40e069266c18407ee18822e4dcdfac878
SHA512 3a3020659c2ce5491ffba16864be0307d6d71bbd2a999ec6e8a4e4f16cd86e5796ee36138c726910abd95602b587afa3e650f5cd1cc709091a4f2cc2ce2ac6b3
SSDEEP 768:va3cqUWZ+LeSFOUkdXX4fouOToPvB2thtA9VAgDb9MY:va3cqRsnnwthttOb+Y
TLSH
T1EEF2C072AC648D73DD95D3A4720A36566FF0C123D6D40F88A9ED9F0D0A57AAD070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download