336c267c7f9071484847e61401b2bc0a2fd5f76d821e48659a71e752e4b2f01f

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260802-plhhcszsft
SHA256 336c267c7f9071484847e61401b2bc0a2fd5f76d821e48659a71e752e4b2f01f
MD5 5223a54b8de71117614c2adbc349ace3
SHA1 b9c32e038b6a002c1ecf54bc3bf5ddf9711713db
SHA512 9578ee498b9a20d28feab9ea3a417fc4714389a5f7ef8d59caaef949d35a3c2fe519c9f5d7ca13099f9b7a809653d10de5af531da9be2e1ca9f89f389d8b9f74
TLSH
T13D51AF25FE03D9E133DBAE73272B3384E27ABB725BB14D00901165503788E2789EA173
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4592	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301470992315214"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{A988A5B2-A07A-48E1-9D2F-FAD9F5C7EFA4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 3788	2756	msedge.exe	85
PID 2756 wrote to memory of 4592	2756	msedge.exe	86
PID 2756 wrote to memory of 756	2756	msedge.exe	87
PID 2756 wrote to memory of 756	2756	msedge.exe	87
PID 2756 wrote to memory of 756	2756	msedge.exe	87
PID 2756 wrote to memory of 4920	2756	msedge.exe	88
PID 2756 wrote to memory of 4920	2756	msedge.exe	88
PID 2756 wrote to memory of 2076	2756	msedge.exe	90
PID 2756 wrote to memory of 2076	2756	msedge.exe	90
PID 2756 wrote to memory of 2076	2756	msedge.exe	90
PID 2756 wrote to memory of 2424	2756	msedge.exe	91
PID 2756 wrote to memory of 2424	2756	msedge.exe	91
PID 2756 wrote to memory of 2424	2756	msedge.exe	91
PID 2756 wrote to memory of 5020	2756	msedge.exe	92
PID 2756 wrote to memory of 5020	2756	msedge.exe	92
PID 2756 wrote to memory of 5020	2756	msedge.exe	92
PID 2756 wrote to memory of 4196	2756	msedge.exe	93
PID 2756 wrote to memory of 4196	2756	msedge.exe	93
PID 2756 wrote to memory of 4196	2756	msedge.exe	93
PID 2756 wrote to memory of 4484	2756	msedge.exe	94
PID 2756 wrote to memory of 4484	2756	msedge.exe	94
PID 2756 wrote to memory of 4484	2756	msedge.exe	94
PID 2756 wrote to memory of 1008	2756	msedge.exe	98
PID 2756 wrote to memory of 1008	2756	msedge.exe	98
PID 2756 wrote to memory of 1008	2756	msedge.exe	98
PID 2756 wrote to memory of 3100	2756	msedge.exe	99
PID 2756 wrote to memory of 3100	2756	msedge.exe	99
PID 2756 wrote to memory of 3100	2756	msedge.exe	99
PID 2756 wrote to memory of 4848	2756	msedge.exe	100
PID 2756 wrote to memory of 3568	2756	msedge.exe	101
PID 2756 wrote to memory of 4848	2756	msedge.exe	100
PID 2756 wrote to memory of 3568	2756	msedge.exe	101
PID 2756 wrote to memory of 1420	2756	msedge.exe	103
PID 2756 wrote to memory of 4780	2756	msedge.exe	108
PID 2756 wrote to memory of 4780	2756	msedge.exe	108
PID 2756 wrote to memory of 4780	2756	msedge.exe	108
PID 2756 wrote to memory of 5008	2756	msedge.exe	113
PID 2756 wrote to memory of 4140	2756	msedge.exe	114
PID 2756 wrote to memory of 3188	2756	msedge.exe	115
PID 2756 wrote to memory of 2692	2756	msedge.exe	116
PID 2756 wrote to memory of 2692	2756	msedge.exe	116
PID 2756 wrote to memory of 2692	2756	msedge.exe	116
PID 2756 wrote to memory of 4344	2756	msedge.exe	118
PID 2756 wrote to memory of 4344	2756	msedge.exe	118
PID 2756 wrote to memory of 2168	2756	msedge.exe	120
PID 2756 wrote to memory of 2168	2756	msedge.exe	120
PID 2756 wrote to memory of 2168	2756	msedge.exe	120
PID 2756 wrote to memory of 4612	2756	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffc57fbc188,0x7ffc57fbc194,0x7ffc57fbc1a0
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,3331661828172017377,10953890555745204090,524288 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,8801368322868799500,3948743713772472035,262144 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,5228186530843850929,11139028255798386766,524288 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,12065831086677144426,16433096529656881729,2097152 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,4407741012897830948,10374352064253704004,2097152 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,13154469843376531515,8946923120715049927,2097152 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,9181179783613816177,3000666468020527894,2097152 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3620,i,14178531520817664440,14085039015567386080,2097152 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5276,i,13287991651417753592,5590197126655388641,2097152 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5224,i,3933218560326739193,17461450867112543037,2097152 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,5994364513104661525,16734585901973192741,524288 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,8657801946733575476,5154850510301339158,524288 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,17079940096366053135,14141412695462175193,524288 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,17079940096366053135,14141412695462175193,524288 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6356,i,3301558188920295787,3131010729964279668,2097152 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,13765044347013507250,14193174050517268000,524288 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,17031985371244676401,15659349730723121211,524288 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,13117882167229433444,14699957545590613365,524288 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=2444,i,13691530228757298937,7212199331407819715,2097152 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,17507176746528651753,4552553900181168226,524288 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=760,i,11147936048357485170,16279857262975764090,2097152 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5636,i,6641421021560815408,17170799091226725337,262144 --field-trial-handle=2328,i,12138473118321259611,18123212764465174619,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2f4b5212eae002215cc76575210556eabcbebaa0c81ba507b656f1ece292f719
MD5 63f13f97c3c8e37c15a952c1e5055360
SHA1 724e6113e0a9d1d496d200372f76fa4c3b77fe09
SHA512 81fe53f8796b814bdb2a4382cc751b29f42ff7589aa9e6de6bede71d1f8acdfbdc3b5bbbae214c99807f99a0162fcc623eb1ad6c36ebcc7e4e2b5d947c0f9ca7
TLSH
T1A471E53B0139446DE353C27192DA82123C7A4EEAF5D35E45B0D05B3D59823F2DE26A8B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4f23e5eada54862b859e182f8f7bb3ebdfc622e87d62ff8f0bbdeffcc4f7ae69
MD5 cf49d177308648f904a2af9b244e1d96
SHA1 fa69b9145b9acf4b549155674846ef8585b832c0
SHA512 a48f8385f3dae0ae857ad21ca16db67728576eb7ab341ee75206737b5f7817ab287aaf7430aa17e2f5dc22147bc3a6e9b4e47d01be18c61f3ccb5f65da81e90b
TLSH
T15111C0F3C3E595AE891516F05A18AE2BCE1D0906522C7C29CAD4FF7793E3075E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f9e1f02b9ddb90f26f74937cad8c0fe843374f2da3ff0c8edab39e6844ab0110
MD5 a6b105674a1547f6698b64d997528fa7
SHA1 c675e3bb1baa627ba649b8101ec9972d51b76b99
SHA512 e32aca1640fa5e5b238dbfa50db4b920735a057002727c0daf3e7ecadb249f559d450886c37c44fde7fdf312b364b8318af0607204a0a026398f06c2416f1d1c
SSDEEP 192:sxZZRdyM/jK1Ml8Mkl/fdssbG/Idpda+HW6+WNGYIk2ujIgrJ:sxZZhMl/fdsMGwvHbGK9
TLSH
T1D142F8126B346977CCDBD209FA457F53D6F90472A2900E58AAFCDA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c45319d88f2e2ac2266980dcea8693ff7234a5106b8d66a05a9d98c34fd3bc9f
MD5 7e06fac1110f088615f107d4e506bbb5
SHA1 6158c09770ec38f4a8dbde6f4c148278ff13821c
SHA512 19049f1e658758c518f4e91d9dd3155d764e12567f8a3701b81f1279a6427803de4e484a559a4c50ea3df8cd81bb217e4e46785c141c7f9309c3984dc6ea2856
SSDEEP 192:sxZZRdyM/jK1Ml8UQXkl/fdsgbX/IdpHa+HW6+WNGYIiF7jIg5cJ:sxZZhqUl/fdsgXwhHbG2u
TLSH
T1DD52F8526A346977CCDBD60DFA457F63D6F8447392900E48AAFCDA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b6bab82411a405d84434318b2c297a222f1d7bdd72f5d306854e8dd4bb1340b6
MD5 a4d4a2388b709849591868397f28b661
SHA1 68603809f07d4ba8f13335f163328b08e4a704ca
SHA512 86af2e489d3ac30a22e4d9f999fb5eea30a2a185254fa49cbe317dd15b30877fc45ddab66799a287286220fb990b577e95f047961bfb7c0d63c1511f339aada4
SSDEEP 768:LHsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9UroFlT:LHsqxXlWvJD6Tu1ja54LAs9/FB
TLSH
T119D21C3B694CC77E4F840E6DEC266FD76ED801CBA6988D5447FA884C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a7ecc3d7e590d8c729a7461b4ba12e0f2274862a73bdf58937054ffde6488424
MD5 c0bc339bc7bc57e496254a24d1589b1f
SHA1 c5ee381b0cdba6a8db61d12f9b559ebf6f7fb32a
SHA512 38e8c411a9731d226abb8d7b387aa35b1b628f4da6fd2f408d98ed2708bd7f226fa7b4c225f57206332923ffe30ce1d3e01ebc58f4838942bde5203c7f10346a
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyJ2IXK7KEHyh5CIfKfqMHy5WInKPK8T:KYbaKYIKa2wK7Kui5CAKfqGqWgKPKg
TLSH
T176D1F056713B12427CBD290CA3FA95374F4232A33419A46E7FB851A65E66E210DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cd743b6-7ba5-4ec0-ad6e-bd8a5c97d8e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6cd743b6-7ba5-4ec0-ad6e-bd8a5c97d8e7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6b91ceabfe241128ae626dc168c162b89e224ad1a5d5d0c4a7833434791485a9
MD5 c8a0f11e8bb64b60eb7940980508116f
SHA1 07f397320243c599dff07ee12254f8611b861d4b
SHA512 f691659271f234dea61e9bcffe3d326c722fce82b3f7ac17d1d044fb2533d7ce992e01f10476033897bce22ad7fdd8f7815d8f6ceb9587775a60b26db4e3e3bf
SSDEEP 192:uDLsN8oQxWd9kRbQUQmiU1brty4VRNX+Fd10IeRfF7SR9q4lU8:QsN8oib7Bt9VRNkd/BHU8
TLSH
T1F132F9366C386C774EA26945F44736139FA4506BAECA3FA4D6EC5F0C01DF6AC130A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 edf6b87ac1e7951a701de74ea8ea5cf7bd06a008140bb6ee90f2059f94a21d06
MD5 e7abd3a9930347043391e3d07f50e7b6
SHA1 9dd7bf1719300e884f7d4cfd724c7e762071ab57
SHA512 6458b79fc955cdba4a88c18740b9a62774a696b0178586ebc857496dec0ac150edee23f6989dde5e73903f1c4b04072212e9b7e877eca9ed759ae0b53b01f8a9
SSDEEP 384:iiFiZcI4zsN08TUNTUlIluib7Bt9VRNkd/gHnTKwBODNZOCkWB:pFQExwgDtjHkmHnewBKZOZWB
TLSH
T1ADA26D735C28987B9EE66E45F94A32138EF850B7E9D57AA4A7DC9F0C00DA19C030BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c1e0f0163c50a7f00e620308a617ebdde90eb96c63144f2b4aedf324e72cbb35
MD5 fbeac1d4ee3fe173651c96e45b204379
SHA1 d272799b67d581e441fdcb200bc8ffc4042b6ded
SHA512 212a3c3d3939b270ed0b3c14b204425988959bd3bf3634bdaa9d1f9dc147fefdbb4bcbe0c1f4c06f299af83c16abdeb81fb18cf48a4c5c4472a4d43f488fb67b
SSDEEP 192:tONu6JkRtQmiUyqWW+RNX+Fd10IeReh3qPR7U6:tONu6UroW+RNkd/FqlU6
TLSH
T1C202C835AC382C7B9EF2AE0AB58737175FE4117BBA962B84D6E81F0C41D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 98e37efad3980411ba84ec7d89e447f85a0743051126a7c59c5618103673e3be
MD5 de5338dfebfc3551e7beead04e1919e5
SHA1 4906376dbd4e5fcac1c04b072f361ddc3bf5b0f7
SHA512 fb7ddaa0fe9aed9af2d10eb9be17a5cc870af8ab4579bacad59cd7f9f5ccb0ade5f66a9aeab7e7acbd61e0eed781754d9305bc36ec08162528acf9b73feefec1
SSDEEP 384:PZcIhsN8uib7Bt9VRNkd/BHnTKwBODNZOCkWB:HhltjHk/HnewBKZOZWB
TLSH
T104928D726C386C775EE2B905F84B32134EF89067FAD93BA496ECAF1C00D9658130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cae8f2fda0fd345627b738c7872dc98aa33db740930dd3368e9ddc328484f650
MD5 79b6f3eb612a1d4f4a7d600d3f087c39
SHA1 d63eb816e8c8ca0cce5612342a67f4f2dd9ef527
SHA512 71838199bff75c584d243f7d4bf1128181017ab42760384d10e02d16b4ff437ec58f7e98fe8400d4c077800f6e6edcc40184d2d96310a0c8a7c8900ba2d2ce02
SSDEEP 192:xONV6JkRyQmiUynWt+RNX+Fd10IeRfFrVc9q4lU6:xONV6Uunt+RNkd/3HU6
TLSH
T17212093668386C7B4EE26905F48736135FE45167EE8A7F90D6DC5F1C01EF66C130A829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e4dae795b3a3f3a1d919394c8f53c8c77d0fd9ac8e3d54ad1958326050a48430
MD5 1f145153667bdec7c6fb9edd3611e11d
SHA1 bc43bf4f3f968b6993b8818a5843a510b62670c2
SHA512 8dea711d7b763055ebd7f3ffd2bda7bf86928ae4a9a54ea93d817aa62b931fea9da74efedc98048d7e50632c832542e3bb37a938bc1df1e07b2d6164a8670b03
TLSH
T1E1413B98A6F91108F3B77F5AAFF7A86D44BFB9772F06D49D10010D4E0A22A44C861737
MD5 SHA1 SHA512 TLSH

Submit Download