2bd380b122e480e4c5158a0a8c26a16cb7cb1b41595b83193ff6c6be34557677

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
thanks.html
Size 107KB
Sample260802-pptpssshph
SHA256 2bd380b122e480e4c5158a0a8c26a16cb7cb1b41595b83193ff6c6be34557677
MD5 0a887551c55ac959ac8d77a224ab6af9
SHA1 93ad23d8384c579d5447827d7d38dad196e40c72
SHA512 d19fbd34077c10863ff4954787dc8e24a34e86adb3e502228432f27170d8628e316f0c54e0df4ffa6aeb428cb12e227c034bcb596ef140d23bf8ba1371a02129
SSDEEP 768:WDGNy5aGtAXlJuKdR8wAJU6gnTlPfnTlPgnTlClnTl7HnTlfInTlqGnTlYJ2rXk+:YaOE+jkQn8C4UEKGu/nHOKi9S
TLSH
T179B395B78A711AAC4906C9436961F9CDE10DE812BB20FBC5B08E5D309B8DE5A4D71DCF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
57	4512	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4512	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301474536094031"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{14FF2EDF-E9C1-4736-9866-0A6692E792AA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
744	msedge.exe
744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 548	3224	msedge.exe	87
PID 3224 wrote to memory of 4512	3224	msedge.exe	88
PID 3224 wrote to memory of 4548	3224	msedge.exe	89
PID 3224 wrote to memory of 4548	3224	msedge.exe	89
PID 3224 wrote to memory of 4548	3224	msedge.exe	89
PID 3224 wrote to memory of 4644	3224	msedge.exe	90
PID 3224 wrote to memory of 4644	3224	msedge.exe	90
PID 3224 wrote to memory of 408	3224	msedge.exe	91
PID 3224 wrote to memory of 408	3224	msedge.exe	91
PID 3224 wrote to memory of 408	3224	msedge.exe	91
PID 3224 wrote to memory of 5060	3224	msedge.exe	92
PID 3224 wrote to memory of 5060	3224	msedge.exe	92
PID 3224 wrote to memory of 5060	3224	msedge.exe	92
PID 3224 wrote to memory of 1976	3224	msedge.exe	94
PID 3224 wrote to memory of 1976	3224	msedge.exe	94
PID 3224 wrote to memory of 1976	3224	msedge.exe	94
PID 3224 wrote to memory of 2376	3224	msedge.exe	95
PID 3224 wrote to memory of 2376	3224	msedge.exe	95
PID 3224 wrote to memory of 2376	3224	msedge.exe	95
PID 3224 wrote to memory of 3560	3224	msedge.exe	97
PID 3224 wrote to memory of 3560	3224	msedge.exe	97
PID 3224 wrote to memory of 3560	3224	msedge.exe	97
PID 3224 wrote to memory of 3980	3224	msedge.exe	99
PID 3224 wrote to memory of 3980	3224	msedge.exe	99
PID 3224 wrote to memory of 4248	3224	msedge.exe	100
PID 3224 wrote to memory of 4248	3224	msedge.exe	100
PID 3224 wrote to memory of 4248	3224	msedge.exe	100
PID 3224 wrote to memory of 1264	3224	msedge.exe	101
PID 3224 wrote to memory of 4448	3224	msedge.exe	102
PID 3224 wrote to memory of 1264	3224	msedge.exe	101
PID 3224 wrote to memory of 4448	3224	msedge.exe	102
PID 3224 wrote to memory of 2480	3224	msedge.exe	103
PID 3224 wrote to memory of 4344	3224	msedge.exe	107
PID 3224 wrote to memory of 3156	3224	msedge.exe	119
PID 3224 wrote to memory of 1768	3224	msedge.exe	120
PID 3224 wrote to memory of 1196	3224	msedge.exe	121
PID 3224 wrote to memory of 3548	3224	msedge.exe	124
PID 3224 wrote to memory of 3548	3224	msedge.exe	124
PID 3224 wrote to memory of 744	3224	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\thanks.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff9a44c188,0x7fff9a44c194,0x7fff9a44c1a0
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,13643806810199684538,7604882329220889423,524288 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,352310734993678099,16446702595554691612,262144 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,10478552350707587112,7673368810732003639,524288 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3304,i,6441528603967841978,9657718820784818781,2097152 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,14952498796953812253,2077200157693099435,2097152 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,13881278687463122710,13631781938678582732,2097152 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,15717726289610819678,18038423137327722699,2097152 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3592,i,8029150687332842245,12040033798257248954,2097152 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,3513135235363002660,4546209311941922535,524288 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5404,i,4416791647328937086,7764861728708419853,2097152 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,7518528863469325510,1248862571095387519,524288 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,9355709769561276094,17652261216676184987,524288 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,15096508542478778580,17384705616241618361,524288 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,17156446676598824443,14427416713165504726,524288 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,17156446676598824443,14427416713165504726,524288 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,18318942795604842623,2241014018480005905,524288 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,542277370228602830,18322940009089053815,524288 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,11010780225309963314,7337287722803484879,524288 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,12977924809707462811,11714260542277593999,524288 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6824,i,7277192417461768684,668172627033178207,262144 --field-trial-handle=2068,i,18424106088407980387,1990943576543980327,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 170dba82c3c1d375809e04168f3ebcd24865503047beaae16ac5acd42a07e369
MD5 3c9aded40c22ce6c2d048535ace0e977
SHA1 c74250e15a13c5f5ac83039050878df1298c44c9
SHA512 2e57432b8359c45e46f3d05d9c6a57eae6ada11c95810c76be1c532993d0a00b71e958c5a942913acd811290e76a78a313f0d89e6f1b2d2cfed07734a97e03a6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1E6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 010183bc7c8524344ddc3dcd23c0aeb8333224f041239a6f9529d2a8ec615da5
MD5 14edabf813c0c77fd5f3bd43458f31c7
SHA1 694f1d5bc2ccd386c851c0d70989a734a7a90655
SHA512 bd35d611111552e0bfbde6c5ea14a1ca4c92676529fdc79b83d8b0640b26229dad20a61a80daded26f450fdf6df09c26e503c4edc5b736a90dcd77886ee1b9f6
TLSH
T1F6614EB849310FA1FBC1807F50F3D249357086D6F8172E7AD050A6785E3EF6AA11AD2D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a61e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a61e.TMP
Size 3KB
SHA256 eb2e7b7977eecfe7f4b3858ce5b6f98187aa9097365a1acbe53c92789df344b8
MD5 bc50dfb031b8ff53dbe63acdd87916a1
SHA1 b09751fa0836508773056e0f1117b8aa40570cf1
SHA512 4fb93b7d6fc257c826ba27d08cfdf44bcdc230ac839c1c1f330da768b01dc4788f6e2406825c9abe93f59123d29b3baeb9b3d66bb1a5081d00d5d69b3bbbb1b6
TLSH
T1EB6160B409350F61FBC140BF94F3D205317086D5F8171E7AD05065785E3EF6AA016D1D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8fa2d716d93a68b6322968555879da801531b02c67bf49c00e7f1d59fc891010
MD5 d99b91403c1496fab4b9e7716117c99c
SHA1 f7076389a5b7d075fcf3e5e0a09bcaeb0204d583
SHA512 2b590123abbbcdd735af5bf5a73ba15a0aa6cd17489f077a2194dec6972df0afd1419b5c942041b02638a54fbf86b69a470e2765deba916b362f15e00613ac3b
TLSH
T1BE718DBAC3D8476E891156F09B257A2BDD1D055B42383C5689F4AF5FB3E20B0E10129F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b4b4fb72f4775c3b0809a129ff2d83db580c61da40c18854105a0dba8555261c
MD5 69eea63bc681287c0a546df16fbc15c4
SHA1 468328a8f5ee406a68f8a8cc0c73b07dd08bc6d7
SHA512 70433e2f975e5c24599579610792104d6a661f4a77061817aa82acc865f7d7dca7e18f9589fe880122c8d983db3a686b4bf14effdc9837635be2d970a36bdd73
SSDEEP 192:sxZKRYyM/jK1Ml8UQJ9A/fvs6Qf9qIdpHaHW6+WNGY9IkiC0wyIg5CJ:sxZKOqrA/fvs6GV6HbGMFS8
TLSH
T13052E812AA386977CCDBD20DFA457F53D6F5047292A00E54AAFCDA1C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5a9d810187c7321508b947952c9b28a5baed4721cb6325ef63343e71450b263b
MD5 27d16a696f2a9559e7142304c0705e2a
SHA1 652ae3f708326ed5240eb8a470d1bff48549f1ca
SHA512 a8e8cd5f7a8791a5ae6ae5cc14231a95b17a43f626de1813b8b4d1158e70c50f4807d3a658518e7ec0b21628523618e59af40ef38d63ffd054798980b956559c
SSDEEP 192:sxZKRYyM/jK1Ml8M9A/fvsvQy9qIdpdaHW6+WNGY9IKr0wyIgrJ:sxZKO1A/fvsvjVcHbG0S9
TLSH
T17E42E8126B34A977CCCBD209FA457F53D6F5057292940E54AAFCDA1C04E6BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 39e941d8ea9ea7293c7867b63d75c007f02274f2627ba6ca6502bd0467d91ecc
MD5 42e9aac299c0ca09d0f07253dd531bf7
SHA1 db5af4f558d56a7a3ceb4e06dae56254b2671827
SHA512 555372ba17c0678c8b35cb0d2f5f5ddbb2488e8d50a818878173331002f69e1817a5db9e6202e8ef25640e46d80fad112671652b2da340e86d13fcf946474d9c
SSDEEP 768:xScv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN/ro4g6P:xScv21wWvu+Z+u1jaeFLeRNs4/
TLSH
T17AD20A2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ae6271a5011d78486ea9f97f3feab536d62dda69054cd040fec74c39d0408e33
MD5 e60c4dc68521fc0918b5a501b721ef35
SHA1 7adbdd3828485a94747fbb9470e7a364ff41534f
SHA512 580e26c745c91d62f531cb5e2a5093a04fe1a2b13e455f5fd5b35d4c9a9cf76a5738264cfbb207a896c018cb8f89563a7dbfec08d6fbbd530ccaa7f47eeaa816
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDKakKDqCC84KxeGz:mT3PTN
TLSH
T126912102303A129228FE7948A756953A4E41326B7818E47F7FB900692E2BF152DFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5940b8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5940b8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 373a3ca650b1c7bba2d8d9c4dc8605a08f1228673a70e68902d1a26473e0bf22
MD5 4efcc97836c00168a2801e643542bb13
SHA1 2b72fcddfe3093c9436d853e137fd55b47759e24
SHA512 d68b767071d2ceb87235a11747c93de0957749094d17c9cf16d119482083116990f7062072f81e74e73f7048c280e2cd06e6ed4424e9a09378526e9ee59bd333
SSDEEP 192:u0LsNQfQphZ8W7VJM+YLeNZQmiU1AMfld4e+CG3+Fdeqmpc+pSJrMOJi/qzU8:9sNQfC8Rzi56Wge+C5ddJrWgU8
TLSH
T1D9322A3668786C6B4EE2A544F04736139FA85177DB8A3F94D2ED5B1C01DF7AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6c35603ebf2bc5fac193a05c5696aea2073570d25227c9d3dfd14280c1cb6010
MD5 8959436a32d4013dfffe4777ea7ca8f2
SHA1 c8feb1e55f251255701f4113b3beb1ad9d573779
SHA512 c9c3fd7aa0053418d040eb6def68480c1d50180d5ed9f63ed5012c00368b64d0a857dcbad4661ca1f60436a19f4d89be07e7caf415e1442deb9e635505c736c1
SSDEEP 192:uaLsNQyQphZ8W7VJM+YLeNZQmiU1AMfld4e+CG3+Fdeqmpc+pSJrMOJi/qzU8:PsNQyC8Rzi56Wge+C5ddJrWgU8
TLSH
T15E421A3668786C6B4EE2A544F0473613AFA85177DB8A3F94D2EC9B1C01DF7AC2306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 552388c2048440a6a7cdc60c162db544935b4c3fde101a036da5317185e32d63
MD5 411465187da6064d99425126e427603a
SHA1 35a45c1e9832247c6a30abcdd7a064fb5e0c396c
SHA512 4278e8042fdddb8cf66711bb30c8b02fadf591ba8091eef8bd9d1ff401fbb3cf8a2350b078d08217e5313bf5aa5a347a664e09e6876410a8a3aad957b2aad5be
SSDEEP 384:siFiZcIrzsNQ8TUNTUlIlUC8Rzi56Wge+C5ddJrNgcDVVZoJHWivJ:XFQ/xwg8pWDhzhNgcleHWgJ
TLSH
T10CA27D735C645C7B9FA6AE44F54B32138FB85077D6D6BBA0E2ED9E0D019B2A8030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 36c2ed9943205c60b09d34faa35b46584efce81f64bc9aa974209c07dc1fcee8
MD5 b13eed3aad2add3827307e556cbf3bc5
SHA1 c39568c7d1b88957809eef37ffd6991f8d0e02a3
SHA512 8c34e9d1bcfc943d48ddafe61b7359b5ed1df1674c1fd8f194fd20e7958ba43b0c9ea138dbf33dc39fb97ee2551ded6d6802515ddbcb9e16bc65f3652f57f3e7
SSDEEP 192:JONw6v+YLNQmiUyibZh+CG3+FdeqmpvusdOU6:JONw6vz/3Zh+C5daEU6
TLSH
T11102EA35A8782C6B9FB2AE45F48737135FA8217BEA912F84D9D81B1D01D775C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b9489302d88294afbbf5f8f880f272b3fc9ef68e529f5c36ba39ab707eeac2ae
MD5 0627638487646918f096a54d52560b08
SHA1 d82eb87fba96a40dd55646edbc7d5c178f42e06d
SHA512 5d59f5369da1d538866489d0341f545cfd503a9b1a28d29cb34da9b6264f571eaa89862e0deefd4ced81918a013f3efd9532f4acfe904641e01afbae3c5aecd3
SSDEEP 192:qONZ6v+YLzQmiUyEObluh+CG3+Fdeqmpc+pSJrbCH/qzU6:qONZ6vzB9iAh+C5ddJrogU6
TLSH
T127122A3668686C6B5EE2B944F08336139FA85137EF8A7F90D5DC6E1C01DF7AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f5f58220cf7994ae463b68a5e9cef416c03cb4623590cd31820452f3eb0fdfa6
MD5 9eaae9a6e2e8aecfb84302e964942f16
SHA1 825f54dffbf988fcc8bfbf2b5bc449c8978818eb
SHA512 bc22662c41d4101c9be97dcd974ab64a569c2e3c2cd84fd88e0546b1f21d8a14b522496c51d5b5a5e874552e36de13386f5e199e8dedbb9229c888baeee4b9a5
SSDEEP 384:wZcIhsNQUC8Rzi56Wge+C5ddJrWgcDVVZoJHWivJ:OhOpWDhzhWgcleHWgJ
TLSH
T15E929D326C782C674AA6B944F44736134FB89077E7CA7B9495FDAB0D01CF7A8030781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35735e74-333f-4d1e-924d-583f3d843cec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\35735e74-333f-4d1e-924d-583f3d843cec.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 42d35b05354f9eb786cd35fd26b409f31f24a8a660919fa1d747cf6eefd19f73
MD5 2df71af01385acba8a519d9590c4d790
SHA1 788eab2f349a5e62a67594da028f8f96bb182fc4
SHA512 50c117ca60d17885bd8584e4de05dfd84235e0d83a4f565c74404459adc50b498f5dbea43787b034af4d0ac69cb8368b41eba69eff866e24cdb6c04e8c33b6b6
TLSH
T17E41D948B6E91158B3B77F56ABF6A46D483FBD372F46949D10110E5E4A22B40C871B33
MD5 SHA1 SHA512 TLSH

Submit Download