ecf65e3c7a78eab392756a18a3654ec999398cf5ee7a1014ea7dd67578c455f6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 235B
Sample260803-phy1yaap91
SHA256 ecf65e3c7a78eab392756a18a3654ec999398cf5ee7a1014ea7dd67578c455f6
MD5 eed9783bf6c5927107e19b2760db3c2b
SHA1 b0b5ed06f34e27c0358482337cbff2ef4d601eae
SHA512 46051da3012f649c85f8974b5ab44e0652997720a049959b1c44f051df16cf06220b67cbf5edfa33c7db6d22eb15b41b1d297504f9cee1d5b320675316cfac25
TLSH
T182D0A7AB2A418C0201B2A6B10E81F24CAC2360A717005502F5CC75133F2532A8EC37C5
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2808	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302332456273381"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{FC388252-5E29-4DAF-A883-E8C3B3D90255}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4172	4316	msedge.exe	88
PID 4316 wrote to memory of 2808	4316	msedge.exe	89
PID 4316 wrote to memory of 4688	4316	msedge.exe	90
PID 4316 wrote to memory of 4688	4316	msedge.exe	90
PID 4316 wrote to memory of 760	4316	msedge.exe	91
PID 4316 wrote to memory of 760	4316	msedge.exe	91
PID 4316 wrote to memory of 760	4316	msedge.exe	91
PID 4316 wrote to memory of 4664	4316	msedge.exe	92
PID 4316 wrote to memory of 4664	4316	msedge.exe	92
PID 4316 wrote to memory of 4664	4316	msedge.exe	92
PID 4316 wrote to memory of 3792	4316	msedge.exe	93
PID 4316 wrote to memory of 3792	4316	msedge.exe	93
PID 4316 wrote to memory of 3792	4316	msedge.exe	93
PID 4316 wrote to memory of 4160	4316	msedge.exe	94
PID 4316 wrote to memory of 4160	4316	msedge.exe	94
PID 4316 wrote to memory of 4160	4316	msedge.exe	94
PID 4316 wrote to memory of 2152	4316	msedge.exe	95
PID 4316 wrote to memory of 2152	4316	msedge.exe	95
PID 4316 wrote to memory of 2152	4316	msedge.exe	95
PID 4316 wrote to memory of 2432	4316	msedge.exe	97
PID 4316 wrote to memory of 2432	4316	msedge.exe	97
PID 4316 wrote to memory of 2432	4316	msedge.exe	97
PID 4316 wrote to memory of 4012	4316	msedge.exe	99
PID 4316 wrote to memory of 3340	4316	msedge.exe	100
PID 4316 wrote to memory of 4012	4316	msedge.exe	99
PID 4316 wrote to memory of 3340	4316	msedge.exe	100
PID 4316 wrote to memory of 3340	4316	msedge.exe	100
PID 4316 wrote to memory of 4792	4316	msedge.exe	102
PID 4316 wrote to memory of 1328	4316	msedge.exe	103
PID 4316 wrote to memory of 5020	4316	msedge.exe	104
PID 4316 wrote to memory of 1328	4316	msedge.exe	103
PID 4316 wrote to memory of 5020	4316	msedge.exe	104
PID 4316 wrote to memory of 4224	4316	msedge.exe	106
PID 4316 wrote to memory of 1652	4316	msedge.exe	113
PID 4316 wrote to memory of 3080	4316	msedge.exe	114
PID 4316 wrote to memory of 4328	4316	msedge.exe	115
PID 4316 wrote to memory of 1960	4316	msedge.exe	123
PID 4316 wrote to memory of 1960	4316	msedge.exe	123
PID 4316 wrote to memory of 4640	4316	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffbf87ec188,0x7ffbf87ec194,0x7ffbf87ec1a0
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,1962171566727998233,3473607054857578728,524288 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,8868265815655753724,5235755535493800298,524288 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,9854727536764296807,2974366838966324946,262144 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,2434316833192056874,2395765307626805502,2097152 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,12470136382428735430,7083392383620252532,2097152 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,7023559997674859111,455464075714293952,2097152 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,8598384022650768776,409149767776273639,2097152 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3604,i,10354672544783916005,3404416225640636426,2097152 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,16503062292611801924,74698641109111353,524288 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5336,i,3473254479319059718,17530239967940937032,2097152 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,13561295202725792762,3738376207491132511,524288 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,14271249776196270350,12857499246477626607,524288 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,10066866792939365002,11801365607670299632,524288 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,5905642083406884699,16937757882950921085,524288 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,5905642083406884699,16937757882950921085,524288 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,17043504482738385850,16578381160593483366,524288 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,12070855530187588524,15444192296396454304,524288 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,11049376020719998510,4945259964431377240,524288 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,4556861293628024254,14562215125486406784,524288 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6864,i,7491514010149946757,6805662040327230713,262144 --field-trial-handle=2444,i,3099762520198821138,4005744598452044473,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 4.0MB
SHA256 61a602b23169ad451a22661e2e356e16ef2bd3c7ef7a23d5892ac4f79baff0b5
MD5 f78efcec4135e6d75d8c7a78345528b0
SHA1 63be2ee0bc5d43d7fa866c0de619a2b3b08dc247
SHA512 188ff1f139144a5b13a05cb3a79da577de84729cc74295c27ea11854c9a6c50dfd104b72fa23347ca0b3910dd698e85f84e5c86dfb406c2f13255d91399c3e00
SSDEEP 98304:26jKjh3j7eFGM+yfq3qHVtgEpIToVtHgVwxqutnxPH8aTtRa:JWjR7eK73q1t3/bHEutxf8aTtRa
TLSH
T1D4163399CA8060F459682F5FB5ECFB45C6E6FBFABC2A4261A0C56157F1F90384132363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f6263e739ad145e8d0bd62423b2296a8ee55f9d58e44f47a13719182ce77353f
MD5 b8d921d6ccc9c490bb09693d21d27e06
SHA1 3e8091bd0a8185672774e35c04f483883655202a
SHA512 902dd8968e923e06804130bb80799946933d961c62a5f8d7360a641c95e4266588e1749fca03675a267e1b06520d587852e592aa532f3618a8ca7e534edd7608
TLSH
T12071E93D040E4469D3AA03F364F213167D71BBDBF6D32E957190AAF028013D68E0F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588f0c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588f0c.TMP
Size 3KB
SHA256 6e2755b6b62ebf9d8794bf8120bb8b40c00e8be29083266d8dc94fc10d0971f6
MD5 3a6dab82ea31909a3b87e041dd548008
SHA1 389c941ae96768ba9c71e591d6c77ea1eab50867
SHA512 e23a35a24f84c11485ed223ec4cd53923a4a66d609c5608b57f2aa2191ba34f7cb6437a1510f2d3382d5bb6e7a7c33ed6a518bc8f1629f6006390cc84a67a776
TLSH
T1BB71D83D040E4469D3AA03F364F213167D71BBDBF5D32E9571949AF028013D68E0F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a1aa65608208007654b303b9be66dc787dcdacaf3b991f01bac2ff289479adbc
MD5 c467c8ee08fe915a6aa5b67ef372114a
SHA1 1edbb8ff5070a8894e0b28996f574a7164b25498
SHA512 2ba46b4519d0d0264bc939112544370ea073da6078eb984a48e17edbb46d7674fe0c59a96b5fe23b5573b21c348c244aa3c3596315496a7d8d9471c483c2fdb3
TLSH
T10231AEF6C3D6866EC91526F05B28BE1BCE1E051593283C1A8DD4FF57A3E2435E202A1F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1f61113f8b54b486dcea2f8fc7602b4df4eaabaec0f0e413235ba22b194119ff
MD5 6198da193f3a17884e5f18c0c837a694
SHA1 63fc2ae5c5bef1fa9c6b493ecaa76d58a655a3b0
SHA512 942207b0da2e5dbf0fc4dbad30c4aff812fbadbba3d324f4fdd7336274e35ce0064b691c103bb2caccb44d5585f33f2d595ff1a3f926f4d81791f27b5e921bb4
SSDEEP 192:sxZuRe9p/fhs5gp5MIdpdJHW6+WNGYzQzalIg5FJ:sxZuCp/fhs5yjrHbGKt
TLSH
T17022D8127E28A93B8CC7D21DBB15BF53E6F95032A1D11E58A6FC961C05E7ACD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5de46ae97540fa3c243e975805036a03e59e358fcb29eb9aa17ef521ed97f21e
MD5 2024936b3e41ce76c3652abc389614f8
SHA1 9aeb166547ce695f5a591c5984f901647302a2d7
SHA512 cf936a0cdbdb194d1d629921466ff7999914a6f7285c1e0b770acc2e6ffcc88894981b10dabf0234ef6a36dde39c29def3379dafe3b16a20c26bbf4eb2345c22
SSDEEP 192:sxZuRe9p/fhsugp5MIdpdJHW6+WNGYzQzalIgrJ:sxZuCp/fhsuyjrHbGK9
TLSH
T10F22C6127E28A93B8CC7D21DBB15BF53E6F95032A1D11E58A6FC961C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d7d1c31c89aeef4fe4216f1065dc2e4ea613380b6855dee7e4c86ef5ee09ac1a
MD5 cd94602c4d53a4aa4901f3716c620e1f
SHA1 1865dfaf26aa5d0d3111e0da2f95f7979d206827
SHA512 d9c48590bd4cfbf8ce83beab2618fcd61c9549903f24bf9154bb49ca86b5c1a1240ca7ac04fb64bfbb6dad4fca6336576e63a3b5d345286a7e5d54a4982932c8
SSDEEP 192:sxZuRe9p/fhs5gG55MIdpdJHW6+WNGYzYBalIg5vJ:sxZuCp/fhs5vjrHbGIj
TLSH
T1D322D7127E28A97B8CC7D20DBB15BF53E6F95032A1D10E58A6FC961C05E7ACD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8f66f20d8fe014ac2100165c713686cb49e1012208e00584eadeb59bc409ab21
MD5 d3c8fd7910a730ac11c484856bc534a4
SHA1 b8c715fbd958f4637073e7a40b686ed9542a4ed5
SHA512 ef3e9eb5db9aa00c5539b1e029e49fa8677836dbb852a507159107967cad204f85a346974405c2f6d73922335ba131ec1e08e7f7f9ff35d2c76a54c9b825a5a7
SSDEEP 768:oCk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBProyIYV:oCk7u70WvqiEau1jai5LA3BcWV
TLSH
T134C2E93B744CCB7E4F801E9DEC566F972E9802C7A6948D4087FA994C02C77EA61264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3c494ade11cb58b0b56bff9451ef1b39bc5c0c04eb0389b8d0cb15b56252f5d8
MD5 574f13e708c4fd3dbe114f205ce91a68
SHA1 2db8d473ce895ca9ba949a9fcb3aa4afb6815e46
SHA512 4d2f39b897a86dd2d768b5231e914ae62ec18191262094c8e6fea3e75006ffe84ee391b2bce1a959bf27cd0b1179a447b364f619a69203d6c3590fb86850fb66
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTfTINKIsgPytBI5KycU7y5UI3KVOl:KIbCKcfTWKIsSuBWKycaaUQKVOl
TLSH
T1B2918307707E0A413C7E385DA1AA852B4F427293345D69EFBFA904625DAAE110EFDCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d9f17ac-280b-4336-8e20-b271301e80fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3d9f17ac-280b-4336-8e20-b271301e80fe.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 32ed9b0d20b2f2a8a5c490f2cba8d5ba9d32c052e5447e616292c7b815519078
MD5 67bd1d96a704583b472f169bdaf85838
SHA1 b45bab1818acb14df3dd0435c740984dd021a814
SHA512 c344c9a2544485291ec3019b576e0f2d6f10f253ac68c9c2e6eb72f5f4c8a0d24883d853c148372d64dae7b557c8c05510e493c6ea70892b50fe137b4393439a
SSDEEP 384:AZcIhsNQV5xVb7AGQd0mEMes6HlytEDq1zWJ:+hBVArkMesoy6DqBWJ
TLSH
T1C1928E315874693B5DA7B102F48A3A134FF89127B7D46F98E2DDAF2C05D92A5130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 01e1ad9407be535a82f6687eb8bdaac740705c525921a9fa5bef1dd543d339f1
MD5 c28e04659b78277ceea1c908f4e8affd
SHA1 14b1eeaf6170b8a19dae8d077b9be38b55663f39
SHA512 bade18417830d70d7000d240dd609f3be18ca62b1a1b3804567f4fd320368e54bd05484f35ec56b917a6d93ddadfca85c524e764ba1bd2c4519e8e4d18a7dba9
SSDEEP 384:QiFiZcIMzsNQ8TUNTUlIlO5xVb7AGQd0mEMts6HlytEDq1zWJ:rFQw1wgaVArkMtsoy6DqBWJ
TLSH
T16DA28E3258B4993F9EA7A641F58936138EF84067D6D4EE98F3DDAF1C00DA2E8130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 27986861c1da3bba4165105d2aa6cdcd2d3a181c3b7c0608d5531b262010af73
MD5 1bb14fed0dd750ec9a1dc9c772a365df
SHA1 0ee41a7f7f4c8b5aee61a17b6a530085f568a83e
SHA512 a9e97c547962b39447e144af332f76af950033f831ef164247ea5fd03160f4624da1b37ec911ef88f7884f897f3569b907a48ef1a85769f3bde6385dff06604b
SSDEEP 192:MONf64BAQmiUyM1CW5GBPKcl+FdGuom1baDb5U6:MONf6eAv4Wzd0mStU6
TLSH
T12C02FA34AC756C7B9EB2BE45F48637175FD8103BE6945B54EAE82B1C00D724C234692B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 91f7c912316a06c2e3fba7093c803f2935bd91add846dba8b1f15b4abeefbf46
MD5 9ac352c17a0263bd8c4dc44341d548ac
SHA1 a19305cd10e01cbbb8e9c4146e0c767f25ccf0cf
SHA512 a084334c9b5a68a520a49474a65341f190824ce1e99d5cb4e552e0455d6ca3847f5985699b05a2523b3842cdff9b3f83a398dbbae58b83e6de2374f2d78d6de5
SSDEEP 384:bZcIhsNQO5xVb7AGQd0mEMes6HlytEDq1zWJ:DhEVArkMesoy6DqBWJ
TLSH
T155929F3058746D3B5DA7B102F48A3A134FF89127B7D46F98A2EDAF2C05DD2A9530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4c939ae6d6f23af3a07538f61b679ced73db9a42212d9153f73c967806e1e244
MD5 21371e54b86cc86af97daa6fcbf3b265
SHA1 c2860bfa1debcc27fad0cd0e18609cb65ac956f8
SHA512 9a7f006eef144bb792f149ecad627e93d0aa87fb969f91e38fcc1d4f6195287d832a1c9ff3f57d816e35c4ca0a23848044d9ffaecbe7efd71296acbc7e1559a6
SSDEEP 192:1ONR64B+QmiUybCS5GBPKcl+FdGuom1YKEMAWwJqFPU6:1ONR6e6vSzd0mEMmsU6
TLSH
T1B4121B316C78AC2B5E92B541F48737135EE4412BEA856F94E6DC3B1C01EF29C630A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b60798b3133f6a7a2e8e236d5bf20b909c9974dba63a59e38c3a4a3657cbd8b0
MD5 aa2b8526ae13c6d9ecc6cb20eb98a294
SHA1 75e359dbdbc366bd7cc0d142c9fe0b5594752355
SHA512 d4fe67271ceef0b27657d1edd4b2b5e19eb66eac325fb51a8edf03c3daedbb0bde6303c607d1223ba3ae470a42265152d4d0f14160b85d260c327ca291fc6c14
TLSH
T12C41E658A6FA1148B377AE2A9BF6A86D587A78733E46D45D00010D4F0A23B44C962B77
MD5 SHA1 SHA512 TLSH

Submit Download