6cc5ce2375cb2f70373722d9dbf22cfdde352c40c8350151f02825ec31e1f8dd

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260731-akemrazdnf
SHA256 6cc5ce2375cb2f70373722d9dbf22cfdde352c40c8350151f02825ec31e1f8dd
MD5 bb8025ff82ee1ce95cc25956019379fe
SHA1 3e7e11f4227ec2a7f651c80ab6befdcf943282e3
SHA512 aba9385ca4d06b0463a2489ea88fb4284cfd9a347f46de1525aef2073c1eb4f96174cb2224f30de83b6c6499e9533f7a9a0f6572250fb3e5d378ffd31e4f1405
TLSH
T1A1519F907CE491DA339587DB3B3BC7F4F39EA909458208076F13DC9439345BAA8625B3
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
548	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299306051913791"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{E2B9BFA4-B9F5-4085-9105-CACF2BBACCE0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 2016	5036	msedge.exe	85
PID 5036 wrote to memory of 548	5036	msedge.exe	86
PID 5036 wrote to memory of 1884	5036	msedge.exe	87
PID 5036 wrote to memory of 1884	5036	msedge.exe	87
PID 5036 wrote to memory of 1884	5036	msedge.exe	87
PID 5036 wrote to memory of 4360	5036	msedge.exe	88
PID 5036 wrote to memory of 4360	5036	msedge.exe	88
PID 5036 wrote to memory of 4680	5036	msedge.exe	90
PID 5036 wrote to memory of 4680	5036	msedge.exe	90
PID 5036 wrote to memory of 4680	5036	msedge.exe	90
PID 5036 wrote to memory of 4760	5036	msedge.exe	91
PID 5036 wrote to memory of 4760	5036	msedge.exe	91
PID 5036 wrote to memory of 4760	5036	msedge.exe	91
PID 5036 wrote to memory of 1268	5036	msedge.exe	92
PID 5036 wrote to memory of 1268	5036	msedge.exe	92
PID 5036 wrote to memory of 1268	5036	msedge.exe	92
PID 5036 wrote to memory of 2384	5036	msedge.exe	93
PID 5036 wrote to memory of 2384	5036	msedge.exe	93
PID 5036 wrote to memory of 2384	5036	msedge.exe	93
PID 5036 wrote to memory of 3016	5036	msedge.exe	94
PID 5036 wrote to memory of 3016	5036	msedge.exe	94
PID 5036 wrote to memory of 3016	5036	msedge.exe	94
PID 5036 wrote to memory of 2364	5036	msedge.exe	98
PID 5036 wrote to memory of 2364	5036	msedge.exe	98
PID 5036 wrote to memory of 2364	5036	msedge.exe	98
PID 5036 wrote to memory of 3532	5036	msedge.exe	99
PID 5036 wrote to memory of 3532	5036	msedge.exe	99
PID 5036 wrote to memory of 3532	5036	msedge.exe	99
PID 5036 wrote to memory of 3084	5036	msedge.exe	100
PID 5036 wrote to memory of 3172	5036	msedge.exe	101
PID 5036 wrote to memory of 3084	5036	msedge.exe	100
PID 5036 wrote to memory of 3172	5036	msedge.exe	101
PID 5036 wrote to memory of 5044	5036	msedge.exe	105
PID 5036 wrote to memory of 4720	5036	msedge.exe	109
PID 5036 wrote to memory of 4720	5036	msedge.exe	109
PID 5036 wrote to memory of 4720	5036	msedge.exe	109
PID 5036 wrote to memory of 4508	5036	msedge.exe	116
PID 5036 wrote to memory of 1180	5036	msedge.exe	117
PID 5036 wrote to memory of 3160	5036	msedge.exe	118
PID 5036 wrote to memory of 3488	5036	msedge.exe	119
PID 5036 wrote to memory of 3488	5036	msedge.exe	119
PID 5036 wrote to memory of 3488	5036	msedge.exe	119
PID 5036 wrote to memory of 4948	5036	msedge.exe	122
PID 5036 wrote to memory of 4948	5036	msedge.exe	122
PID 5036 wrote to memory of 5044	5036	msedge.exe	124
PID 5036 wrote to memory of 5044	5036	msedge.exe	124
PID 5036 wrote to memory of 5044	5036	msedge.exe	124
PID 5036 wrote to memory of 4744	5036	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7fffe38cc188,0x7fffe38cc194,0x7fffe38cc1a0
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,8675858811880654850,16110285348530554027,524288 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,2394212329096867737,11359032118858186091,262144 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,15020735439642581606,759601689012143894,524288 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,14619843217617454941,6639541486176049300,2097152 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,9281328219206158257,2058700385022410817,2097152 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,10955276483111915470,9233751698935792801,2097152 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,17446205210059459017,8742842190251526718,2097152 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3512,i,16523106965727833928,10441555632421774047,2097152 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5220,i,10706259469394925238,1675070595372665,2097152 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5160,i,4455065020131915492,10296360689112759501,2097152 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,17396911337985337074,12003539136470951157,524288 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,8353904071489145838,573379076169065790,524288 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,12753200123078254857,4220936229549804031,524288 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,12753200123078254857,4220936229549804031,524288 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6212,i,4643685657070161363,16264297031580581605,2097152 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,11588015757835310766,13732375211132993380,524288 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,5070129407757618366,8712837300806540306,524288 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,18364240957069514828,14088580168290794369,524288 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4344,i,2920726736623819422,10488286618149993603,2097152 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,11563113606448281725,7468623279645725375,524288 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4500,i,8475417749554199801,12698813920331900709,2097152 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5504,i,17634801261854541147,3932767319980101330,262144 --field-trial-handle=2228,i,1027721247187625292,13294738914113059411,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5ab42e2f3eb75b37ed181d68c926be2551ab35e394c88e258ee260d9aa9826d4
MD5 1f8220246bc0502095f58cc2ce49993d
SHA1 f4b240cc352793cc8fb9708a0f59dab5f2492a1f
SHA512 3ba31ad68f6089f5f324b346b415e0a674a0d269df857523a2daf06e173630895e508dc92d59432510cd97791008f05f380bde507f0bf569b7f8cd632b1f3f35
TLSH
T11C612B3407526BADFBE11E72E8E147057432D32DDA73FC1C6060A6BD6507727602611B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c30d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c30d.TMP
Size 3KB
SHA256 779deb44810a5e1160722f13b92d6af3a5b68b0654a92d843417f9489b92878b
MD5 f483772d731ed72e469366645909b8ce
SHA1 6686d695db98d0abfa011b86c788c7ae6b77d4da
SHA512 bd2fdd71ca7d7dc8faec80f1d75768630fb37eac7f5cb51ef079a7262ff26281a304a155d2bb5070a8abd209ee08bb18dfb824afa1ed1c95d53bbad2c32d1edb
TLSH
T14D612B340B526BADFBE11E72E8E147057432C36DDA73FC1C606066BC6107727A02611B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9801e89de0854e71f613e06c37475511ff509d93d7947702271c4875e1d34a9b
MD5 2677868256d6ff204d38af9c57bf05e9
SHA1 4210e6a87f91d35c340a22790cf52a28dcd74f31
SHA512 9403b5c5823ed08e048cba569c48df04ca8a187929b87a5b4b064a1a4c44b2b43c5ca688341fc4e42b8ebf63fff47147234cb7ff1fcf9576ff5e7677a3390cef
TLSH
T1811160F383D595AE891116F05A14AE2BCE1D0505432C7C66CAD4FF2793E3475D10195B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 43a81683ecad06a434a2b986fbbbf2e2ed262c65ce9640df37e2c2e6024fc96f
MD5 d06bc54376626e526b292db424a55010
SHA1 f0b45358708e29a889b6371aeff3c4fcd2d49bc2
SHA512 cf6fc5dc509372c9bfdfd754332a25eaa75aaeacc43d3da506f9d3a3f661b2c586ee609b8c38fc95eb26c5794f70173a06cdbb8b4aac2d09345dcad66390a11a
SSDEEP 192:sxZIReyM/jK1Ml8Mk+/fqsVrG8Idpdi+HW6+WNGYLzIM3IgrJ:sxZIYM+/fqsVqlDHbGo9
TLSH
T13442D816AA345977CCDBD209B955BF53E6F90473A2900E54A9FCCA0C04E6AED2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b49df6f015d0a89173383ae8391d1f15cfd3fc8dd1344b88a67d9edd3f531cdc
MD5 323f28f24e0a99fd5fc5312380546250
SHA1 2a3509ac8246a00d6d74a4c28bad61f85563f535
SHA512 675f547b8d41b2b63bfd58a1d08032c0f1f1963f4a5e04db3dffe2e4b99920219c496052e004f8a1021ba2f0336738eb834f6715da3ed91ecae529a85be94787
SSDEEP 192:sxZIReyM/jK1Ml8UQlk+/fqsMr78IdpHi+HW6+WNGYLtb83Ig5NJ:sxZIYqu+/fqsMXlNHbGXJ
TLSH
T14D52D616AA345977CCDBD609B951BB53E6F90472E2900E44A9FCCA0C04E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2795be9792e232fc0170636273cc2eb60f6897af7977b8159998e914e63b66dd
MD5 ea941fc4408952c5a2455ec51518d3a3
SHA1 ad9f0ebab9feb0a3dbb160b33f21aae16aa76925
SHA512 1dc25ab97319700c2b377f0ca263b00cf885b237e923d6cf5c6d7ffb412d1bb5729909d39ecbf6c9c7f2ddd124d20acd81511b925bbbaff48fbdfbab6fbbf4de
SSDEEP 768:aYs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN5ro9S:aYs6pD1WvxzWju1jahILIsNy9S
TLSH
T194D2FA3B680CC77E4F841E5CEC2AAF967DD801CBAB98899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 39b4f567a23f03a5e9a0d958b8d8836b5409adce514845a953bb9d6c02f6f025
MD5 66b121fac910e211586610a84deae5c8
SHA1 f8b07c86513589ea9914044df46d41c7bbc679e5
SHA512 5251c05f61116ab3c2727fc2c7e03d7432a2c0e4568e0e7756f70f8f2d9ed6bcb2928704693c8826492e1158018c25928f281aad1c5ff5cb8e63ed60cff5f895
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyhoIrKVicPdIxK2cUjy4nIZKYIsr:KUAAKtePiogKVi2dqK2c6bneKYIY
TLSH
T12DB11617327A02423D3E3A4883D58BA78E8271533119A42B3BAC0471DE66E25DEFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7faa7de7d4c92198bfe3715e4fdd4f75fbfb1f3437c003ce9e0982de30698183
MD5 d7fb5ead5f974f5ccda9a1186d1bc343
SHA1 e13c4e8b0653992706e75f5f60c6e2a156943546
SHA512 b416010365d772670a0b4f238bd65eaf926a059df46ab57b210fc250d483ad956ee4f5d730056d8554b26e3f14bc9ea2bc166de1b4bcee4e302ea82d275e5aa8
SSDEEP 384:/ZcIhsNzwDZKQRgAX9ga91O+MzozJr6zOObjI9G6w7FG:XhrKgNJHOZMh6z29Ms
TLSH
T173927D31AC684C7659B39516F98735275EF8807BEBDD1E84E1DCAF0C05EB9AC130AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d9ab6a7eca4e240504abc0b7b728d9069c9b2376b9ba68c48515a2ff12d2f9f7
MD5 8fe873a99b2e7e937908049f8cc899ff
SHA1 b219a5e67cd4146af6a8d434ba9576faf5d9b1bc
SHA512 b2be0257ed0165806c0e68f7620067f9a535b77c90816eafb55b94743c6d02ce2ff984553a17e8a15e1ea3cd74ae90d76abe348ca846154110aed8a6e2326c0a
SSDEEP 384:AZcIgzsNz/DZKQRgAX9ga91O+MzozJrDzOObjI9G6w7FG:+88KgNJHOZMhDz29Ms
TLSH
T1CB928E35AC684C3659B39506F98735275EF8807BEBDD1E84E1DCAF0C05DB96C130AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 61e3d92d2f491a42a08f106d55e74b33023665e7198e9f0c516ff3e72c9cd56f
MD5 1de0aa8d540073de9c5ad6b7d829bc9a
SHA1 36659d3e7fc59dda84aadb03829979de09d785bc
SHA512 b5512d37a7588efbcec754f02f32bc4f813b49f79cb1c388dfa15ebe16f758a15406b8e9d1707a83b342ea9c9132d7d0e400eb9445b7d5b4dc4d5929739958ac
SSDEEP 192:qONQ6O7+3hQmiUydPGttb0IO25h2sgGTv1U6:qONQ61+Gt91O+MCr1U6
TLSH
T11E02E9346C785CB75EF3AD05B58737235FA5112BE9962F84D6D81F0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cc1fd2952e2931dcc1b2c8b1f07a7f85e2ba6cd60cb122440855e3ef3132f793
MD5 2e65340aeb3ac87517b0ded374968025
SHA1 7d5f2b43d5237576f7fb9ad897929b1fc3434e77
SHA512 4b0a3faa1adf6271426edb15e5e4314e31c9f95a4d065fa40ade31b39315a22ee70287ebc5743d5f16cc321d5d301675df91bafc9e7a617cc3c95a520eb958f1
SSDEEP 192:IONm6O7+3wQmiUyHPAttb0IO25h2zMZF0SJrPcNAqJDU6:IONm6iKAt91O+MzozJrMzU6
TLSH
T1D5122B35B8685C771DF3A545F98735139EA5412BEE8A2F80D5DC2E0C01EFAAC234AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4229b4e83d17b55218606f39d6c246d9f2628a0cffd923f01c7ade51fc492bde
MD5 b842de0317c0da2ff0489719cdf212af
SHA1 35a1ea6f0b76554b2a75edfb1cf6e2ecf4c0ecb5
SHA512 8e3899b889d2515853f2e4dc2e541ab3efa6d0fb1620040a761b1fb9eb989d7b83370d04d7405ce0298bfaead2df5edb225aa0bf20ba865b0769a1119ee637de
SSDEEP 384:6ZcIhsNz/DZKQRgAX9ga91O+MzozJr6zOObjI9G6w7FG:4h8KgNJHOZMh6z29Ms
TLSH
T176928E31AC684C7659B39516F98735275EF8807BEBDD1E84E1DCAF0C05DB9AC130AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41a4eb4b-941b-41e6-82a9-c96155bf65d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\41a4eb4b-941b-41e6-82a9-c96155bf65d1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 895c16c606a16a8474cee5f78d567518203ea0c0e3751f3a0f82820c0a838623
MD5 59a19de3f9177a0c57fe5435f2649d73
SHA1 c3560c873791d2b7cf46b2d62eb84df15c562daf
SHA512 8eb539257d2feaf6133cb9eeeab239d73dfc925c283a5ef9654233af61e1441a6952887a75a7b196de2b6377332514276501c83af381c3ce48a6eb7d8bdacbcc
TLSH
T1FC412898BBF91148F3B76E5AAFF6A46D447ABD332E06C45D10110E4F0A27B40C962B37
MD5 SHA1 SHA512 TLSH

Submit Download