d374021fe252e3247806d09481864f5134f09688cb068e9e38a871fda69e6cf3

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 241B
Sample260808-pgdnlsz1dw
SHA256 d374021fe252e3247806d09481864f5134f09688cb068e9e38a871fda69e6cf3
MD5 f03032529d449117c894b14b88f01714
SHA1 1ba0b2e8ecffa52453d9945fef17358e6f55d359
SHA512 a9070c13b5c6123ff0231e9ad4506ecd4a3af7484011298f585b30e10ee5ff63874ec5faa9654973edcbd3353d90dc84535560a7d191ef2e03d76dd1d5643f07
TLSH
T16ED05EBB6A415C0005B2A6B20A81F248E82320A616006602B5C871133F6562F8E87688
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3592	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306650678722634"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{2D48D672-19DD-4E8F-8335-CEFA9FCBADEE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 4572	2672	msedge.exe	87
PID 2672 wrote to memory of 3592	2672	msedge.exe	88
PID 2672 wrote to memory of 2716	2672	msedge.exe	89
PID 2672 wrote to memory of 2716	2672	msedge.exe	89
PID 2672 wrote to memory of 2716	2672	msedge.exe	89
PID 2672 wrote to memory of 4552	2672	msedge.exe	90
PID 2672 wrote to memory of 4552	2672	msedge.exe	90
PID 2672 wrote to memory of 1696	2672	msedge.exe	92
PID 2672 wrote to memory of 1696	2672	msedge.exe	92
PID 2672 wrote to memory of 1696	2672	msedge.exe	92
PID 2672 wrote to memory of 4548	2672	msedge.exe	93
PID 2672 wrote to memory of 4548	2672	msedge.exe	93
PID 2672 wrote to memory of 4548	2672	msedge.exe	93
PID 2672 wrote to memory of 3304	2672	msedge.exe	94
PID 2672 wrote to memory of 3284	2672	msedge.exe	95
PID 2672 wrote to memory of 3304	2672	msedge.exe	94
PID 2672 wrote to memory of 3304	2672	msedge.exe	94
PID 2672 wrote to memory of 3284	2672	msedge.exe	95
PID 2672 wrote to memory of 3284	2672	msedge.exe	95
PID 2672 wrote to memory of 2544	2672	msedge.exe	96
PID 2672 wrote to memory of 2544	2672	msedge.exe	96
PID 2672 wrote to memory of 2544	2672	msedge.exe	96
PID 2672 wrote to memory of 720	2672	msedge.exe	99
PID 2672 wrote to memory of 4176	2672	msedge.exe	100
PID 2672 wrote to memory of 720	2672	msedge.exe	99
PID 2672 wrote to memory of 4176	2672	msedge.exe	100
PID 2672 wrote to memory of 1452	2672	msedge.exe	102
PID 2672 wrote to memory of 2612	2672	msedge.exe	103
PID 2672 wrote to memory of 3960	2672	msedge.exe	104
PID 2672 wrote to memory of 2612	2672	msedge.exe	103
PID 2672 wrote to memory of 3960	2672	msedge.exe	104
PID 2672 wrote to memory of 3960	2672	msedge.exe	104
PID 2672 wrote to memory of 2808	2672	msedge.exe	105
PID 2672 wrote to memory of 3884	2672	msedge.exe	113
PID 2672 wrote to memory of 3296	2672	msedge.exe	114
PID 2672 wrote to memory of 3240	2672	msedge.exe	115
PID 2672 wrote to memory of 4928	2672	msedge.exe	119
PID 2672 wrote to memory of 4928	2672	msedge.exe	119
PID 2672 wrote to memory of 4276	2672	msedge.exe	121
PID 2672 wrote to memory of 4276	2672	msedge.exe	121
PID 2672 wrote to memory of 3244	2672	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe06f0c188,0x7ffe06f0c194,0x7ffe06f0c1a0
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,7171543506197240684,17615942544661083303,524288 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,13306653388753662154,6191624666241445134,262144 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,11058276026260426087,4548887833066665757,524288 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,2649928115951583747,14319499186369560931,2097152 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,9856279964672121449,7408888742235328437,2097152 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,1852727166251954685,13081873486863730052,2097152 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,2886783898704752969,41518563059351380,2097152 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5024,i,2763455186753219449,3313487718509773524,2097152 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,15066092869786546300,9096124309621804284,524288 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,3509622524984624489,12998488127294031718,524288 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,8874856111174731814,1357679285320900808,524288 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,8874856111174731814,1357679285320900808,524288 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,3794639840254295875,7198589021872389362,524288 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6316,i,17943399765459993983,10659787671553341490,2097152 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,8861019883579106676,10595034045012307939,524288 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,14023244372022153420,15389974941534089225,524288 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,14056448262204533502,13259463404749329342,524288 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,16556111583330340981,12755248697036343521,524288 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,7843682965278398062,17176400762349585024,524288 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,7666782931131793485,11834264590469714586,524288 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5692,i,7184782823363171190,15803539958629181170,262144 --field-trial-handle=2256,i,11440631501644204317,16065769237837667437,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f2181bbda710458426c4f1e77f7f55418d3e0a69bdd9c2d856ca357d2be48ab6
MD5 13528cde23d675577da3e9643022dad9
SHA1 4ddcd72bc0d4f214345d0c18e39045b66d2737dd
SHA512 fe159c910c5d9767c57b723111e39b09086e08209f9973e3fa47143cf0e3f6e5bb70bb05a20dca77159ea2647664b533180812f0a6fe770ec3d7c712c3aded28
TLSH
T1706109FD176208E1E7694071B0E2064074BC3EDAF53F7E8E535088FA6616F668F5928C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d8e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d8e6.TMP
Size 3KB
SHA256 84ded7f9ed1e07e482339a8eb677c7712e51d281c91a1d5ad9b44cb734bf50b4
MD5 548207874c05c042c9405d76dcc6dae3
SHA1 ecadc96da91fa352e3b6b8d46a998d37517b8c5c
SHA512 d4491b879e81a01194deb53c0438202ee1755681c324a4361b8aeeb3ce67d7c5a0a93e506066bcd08e541639a851312e290d603fda5719ce5ef246896b7dd6c3
TLSH
T15C6119FC176208E1E3694071B0E20640747C3EEAF53F7E8E535048FA6606F668F4928C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 92c31f2127e899fd0b1b680aa50f149b5c1731f91beee64b1c370ff29458db45
MD5 596a2718413d52fb4b61d33449e95e53
SHA1 b5e281820b5ece071e41a9eab9a67a65a9d6db87
SHA512 a352cc97c9b0cb2c15b096ea04f833c341548ae6abf27ab9e340891aa84411b9de065fa74421a915d8175630b41f6a40c9d3420852b69476a28296e450dee7f3
TLSH
T159317CB2C6DA9B2D892126F05A147E1BCE1E052497683D168ED4BF4763E2475E201B1E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bc4ca2b3825150fd057251190597938a4352adb10df3b41710039396d01bf099
MD5 a4dbde15cc3f2bffcf50f02851486134
SHA1 26c912ec5b24eaac1fb002fe30a90e36e67174e2
SHA512 24e89250747c1478ff42e0d9c9831f1886aac50da8370e80c0045c21bc4ebf0547d94f6a9d49a83080a4978969020589b0a11e28334aca6da8645798801e16fc
SSDEEP 192:sxZU3RVyM/jK1Ml8M9c/fIsy2HOIdpdoHW6+WNGY9IKzbfIgrJ:sxZU3B1c/fIsy2/iHbGa9
TLSH
T1EA42F811AA34A977CCCBD20DFA557F53D6F8547392900E54AAFCDA1C04E6AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cac022a679b3ffae3dd6379d05a4d6d9003a90cd47cc73fbf79fdb68126239d1
MD5 13e3bb1b5df88af4239e29c9531e67d1
SHA1 4928be5c19f6f3035480ef0f18a5576100861e45
SHA512 4c8ae75760a36ca086893545f596e36dae74a2870c0dfe77e8194f7cbd556e3e22549d307974468f5a00dfa21d879479b3ed399a79e669ec29bee6729cded8d1
SSDEEP 192:sxZU3RVyM/jK1Ml8UQA9c/fIsL+a5HOIdpHoHW6+WNGY9IOKbfIg5TOJ:sxZU3Bq2c/fIsL+a5/IHbGr4
TLSH
T1F252E811AA349977CCDBD20DFA517F53D6F4547392900E54AAFCDA1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5ff02cd892e5f0a5233d4e93d76e9ef702199e2beb1384ce9eec17e3178f32f2
MD5 01699d17c8b5cd7d6d4781e69c5b0a73
SHA1 d924d306089e83ae6201ed5ce335807319576eb6
SHA512 201fddbf1655bed47d45dd1bffc1b140102ff18f8872059d3b64280dd49f091059e73e0227032614312f5ba8ba03cb86d2aed70a1dac6d81713a4ca2b193b301
SSDEEP 768:bYcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNAroaKg6o:bYcv21wWvu+Z+u1jaeFLeRNLaKY
TLSH
T1A2D2FA2B280CCB7E4F841E9CED2AAF866DD801CB57988D5447FA494C02C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 64432d4fff14c721705cd783ed5d896e153e1eb19792045130dec8c94076090a
MD5 ff709cbce626dfea4068237f577ffd6a
SHA1 1fa55be84636d1b63e3c95f59c2ca5b2b923d9cc
SHA512 b52e966def06caa5f87a76abcb3c5af78b07a7d9b52536afd55bf7362a62f5d6efb1ba3ec3a22d7872ef5035ae9a725977785b75e4cfa4f4930feba4c30c86e9
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD+1vSKM4Ku7OKgUp:mTzhps
TLSH
T17C916652747E02912D3FBA0DA6A589369E8131E33414E42FBFA910A54E6BE105EFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 67c6c3b1d0589f5908cdfc186573498bb42bcaa7c887d3c44ae311828f85a315
MD5 c84fc2034ef65af49c62c93ce230787e
SHA1 757e10a1c76932dfd6f2f84c691e5b0b820cf7e1
SHA512 c78271ada9a35b518bdab9b1b8b1e6a909b9da0b872d3f603d5629d221d9b672bf6edb73827133f6739ec98c46a09f6e9fd7fcd9b183a2238a4bfdc6d48b8d87
SSDEEP 384:1ZcIhsNDk62vzibuE+e+CMdceCBS+20rnTKwBODNZOCsKDg:Nh97M5klCcl0rnewBKZOb3
TLSH
T122928D31AC385C779EE6A505F84735135EB890B3FAD83F94D5FDAB2D01EA6981306C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d6c6d64d0e6e233ea51488e4516623040df35057065f170d1c866cb3d7b16a5a
MD5 341a3ccfb7c31bcc522c0de8697f8f9c
SHA1 4f454bb84abe35a828bb1f93f7897b2c5104de31
SHA512 1d3f4f50ecf716fe2436f08e37d1cfe92efa31f52dff803b4158b682b2a61678a901c147841e5b1c5ce04a6f26164598739291efc4c04bac210104be7d8f9935
SSDEEP 384:oZcI0zsNDj62vzibuE+e+CMdceCBS+2TrnTKwBODNZOCsKDg:WIk7M5klCclTrnewBKZOb3
TLSH
T1D5927C71AC385C379EE6A505F84735135EB890B3EAC83F94D5FDAB2D01EA69C1306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ae5f3a1c9767472ed4edf3313d05ee8311e3efdb05d0b87fb5ae802a8a04d1f
MD5 f9dfeeabe624c391bb40fb8bb6d56cbe
SHA1 33eff927802f7f1a2ec98dc284c7ef72b6a06b6c
SHA512 a22977ff940c5b8c6b86933c9d32b3269a814c3ac01a8404f501b4c458b64812bb9625c99067fa4f32ec03f5625acfde376488f7c688b9bb6f11da304fefc634
SSDEEP 192:JONU6v+YLNQmiUykwMZh+CGy+FdeL9oCXuswfU6:JONU6vz/vZh+CMdceCD2U6
TLSH
T12802E9357D382C6B9FF2AE45F4873A235FA82177E9912F84D9E81F1C01D769C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2cdbf11eebc0ebcc31e4204b6cce756eb80d3941419ed555b9e6221784cd5e8c
MD5 e69b5b928c17b6434a5ee0a1795dbea4
SHA1 925f2433be14b4d06758c36382da3e5400e8e00a
SHA512 45dc8abf419cc98ac9a8f1c5413729dfca4c26d6c61ce1abde8cbb3f3656bcfd2ea50629226c2c034b8ed483ac15556a52b24bdb42f08b22113ce32b6ff6496c
SSDEEP 384:PZcIhsNDj62vzibuE+e+CMdceCBS+20rnTKwBODNZOCsKDg:Hhk7M5klCcl0rnewBKZOb3
TLSH
T1A1928D71AC385C779EE6A505F84735135EB890B3FAC83F94D5FDAB2D01EA6981306C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b8723265154212e49d878b60f50dfa05f2e52e058e4a5bc00c3ddddb83fb67df
MD5 1c742134388ff360be10ef439d381435
SHA1 2c1969dbf9043035d0e7e77fc54740920fbe1c0c
SHA512 c0628c36af23663f27e8e682d7087b078a4dc05c3f0ad5cfa658dfe4153dad9d49bb9f8d3372deaae66915af55c040d8a8225abcec57974571f6437c4495850e
SSDEEP 192:RONO6v+YLTQmiUykXBM6h+CGy+FdeL9oCd1FS+2vCHTq0U6:RONO6vzZzi6h+CMdceCBS+2ErU6
TLSH
T1E3123B35AC386C6B5EE2A541F48335135FA45167EECA3F80D5EC6F1C02EF6AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7ca73f0-c0d4-420e-b6e5-cf140d989922.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d7ca73f0-c0d4-420e-b6e5-cf140d989922.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e0d11cca36ec9d419531f0d779a03fc07a4dcc68e0c982294816bf60fc2835d9
MD5 e0d68de45cda77c66a178429490b672f
SHA1 a5b1b8c80b65373d59483fbc78f590cdefc3f8e0
SHA512 c5f6c432a9a4e3adbdb96293596fe7a3fdd3e8cdc20f9d8a84d7f271ba80963f416b2311bc13b323c1451a3d0e8062844b97b34acc0bd49d1b6b09d7441cd3e6
TLSH
T1BA413958A6EE1108B3B76F1AAFF3A46D443E7D732E06D49E00010E4F0A36A04D8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download

M_X20260806080501.zip.crdownload

Path C:\Users\Admin\Downloads\M_X20260806080501.zip.crdownload
Size 4.8MB
SHA256 a7f8757c780afc2fcb081f861b3be24b0be5badd3042f759e8af4fd47380dca2
MD5 875e574f67c128a1049b6f8e7fde265c
SHA1 cf182be1a4f49cc2bf3199bd920256d045d1eab4
SHA512 fca2a13671b631620904babdd72068a02dd80a02b53e5e67c5d4d800199ab5f188778449a7aad6a5849a4aa9c7e42a66736340451372f20779cb09a228f428a9
SSDEEP 98304:GkbgQSVNKQRIuzHYROG+kZYQo4Pch5szclva5a3qBREX/cKw/uAw:nbgQlUZzIOG+MYQo40778a3/0dlw
TLSH
T1183633E59840A100488A3905B5E39F945E42FF7AED5FC2A6A7D2DFC7A4E9F431C02D91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download