hxxps://getpolsec[.]com/ad/2163a3b5f73255bb4a87a49822263b68fa412879e14304582364983f354b692f

Analysis

user interaction
yes
max time kernel
69s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 19:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getpolsec.com/ad/2163a3b5f73255bb4a87a49822263b68fa412879e14304582364983f354b692f
Sample260808-yp65kafc49

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4284	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306927397305521"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{B6B2B398-0634-4714-8A88-B20244CCFB6E}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3884	2412	msedge.exe	84
PID 2412 wrote to memory of 4284	2412	msedge.exe	85
PID 2412 wrote to memory of 2232	2412	msedge.exe	86
PID 2412 wrote to memory of 2232	2412	msedge.exe	86
PID 2412 wrote to memory of 2232	2412	msedge.exe	86
PID 2412 wrote to memory of 3728	2412	msedge.exe	87
PID 2412 wrote to memory of 3728	2412	msedge.exe	87
PID 2412 wrote to memory of 4244	2412	msedge.exe	89
PID 2412 wrote to memory of 4244	2412	msedge.exe	89
PID 2412 wrote to memory of 4244	2412	msedge.exe	89
PID 2412 wrote to memory of 4280	2412	msedge.exe	90
PID 2412 wrote to memory of 4280	2412	msedge.exe	90
PID 2412 wrote to memory of 4280	2412	msedge.exe	90
PID 2412 wrote to memory of 2004	2412	msedge.exe	91
PID 2412 wrote to memory of 2004	2412	msedge.exe	91
PID 2412 wrote to memory of 2004	2412	msedge.exe	91
PID 2412 wrote to memory of 4644	2412	msedge.exe	92
PID 2412 wrote to memory of 4644	2412	msedge.exe	92
PID 2412 wrote to memory of 4644	2412	msedge.exe	92
PID 2412 wrote to memory of 3404	2412	msedge.exe	96
PID 2412 wrote to memory of 3584	2412	msedge.exe	97
PID 2412 wrote to memory of 3404	2412	msedge.exe	96
PID 2412 wrote to memory of 3584	2412	msedge.exe	97
PID 2412 wrote to memory of 4764	2412	msedge.exe	99
PID 2412 wrote to memory of 3568	2412	msedge.exe	107
PID 2412 wrote to memory of 3568	2412	msedge.exe	107
PID 2412 wrote to memory of 3568	2412	msedge.exe	107
PID 2412 wrote to memory of 4604	2412	msedge.exe	109
PID 2412 wrote to memory of 4604	2412	msedge.exe	109
PID 2412 wrote to memory of 4604	2412	msedge.exe	109
PID 2412 wrote to memory of 5128	2412	msedge.exe	115
PID 2412 wrote to memory of 5136	2412	msedge.exe	116
PID 2412 wrote to memory of 5144	2412	msedge.exe	117
PID 2412 wrote to memory of 5852	2412	msedge.exe	121
PID 2412 wrote to memory of 5852	2412	msedge.exe	121
PID 2412 wrote to memory of 5852	2412	msedge.exe	121
PID 2412 wrote to memory of 5916	2412	msedge.exe	122
PID 2412 wrote to memory of 5916	2412	msedge.exe	122
PID 2412 wrote to memory of 5916	2412	msedge.exe	122
PID 2412 wrote to memory of 5984	2412	msedge.exe	123
PID 2412 wrote to memory of 5984	2412	msedge.exe	123
PID 2412 wrote to memory of 5984	2412	msedge.exe	123
PID 2412 wrote to memory of 6128	2412	msedge.exe	124
PID 2412 wrote to memory of 6128	2412	msedge.exe	124
PID 2412 wrote to memory of 5156	2412	msedge.exe	126
PID 2412 wrote to memory of 5156	2412	msedge.exe	126
PID 2412 wrote to memory of 960	2412	msedge.exe	127
PID 2412 wrote to memory of 960	2412	msedge.exe	127
PID 2412 wrote to memory of 960	2412	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getpolsec.com/ad/2163a3b5f73255bb4a87a49822263b68fa412879e14304582364983f354b692f
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff871f1c188,0x7ff871f1c194,0x7ff871f1c1a0
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,7943871366488830265,1040808894914285323,524288 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,11669043161549347313,12882819438529174462,262144 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,10634991391100645384,13346836593027539865,524288 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,13411804376739129379,1998983546565625057,2097152 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,10174887722406284041,4722553535261213328,2097152 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,11426075357262281429,17728091072476029927,2097152 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,8814864017467165547,14205727067677783089,2097152 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,6325883852042620409,5243557265163986798,524288 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,10359347547406076791,17289924069993594814,524288 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,12174671980746672626,7711176963943489911,524288 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,12174671980746672626,7711176963943489911,524288 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4468,i,2750193502812536184,8928218850064048645,2097152 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6424,i,12550591122843107598,11769552176641980138,2097152 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,10899012484335866225,13038241497442472192,524288 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,3280906757139775615,11789043973019965312,524288 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,2472401764183726305,11995301561334945200,524288 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3608,i,5305642752474484483,10055242443318333493,2097152 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6524,i,5676604651053892144,4010940313311667113,2097152 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5692,i,10067200220650192856,10147376522046858207,2097152 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,16882000243838622162,11211697005309506132,524288 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,3702957584149604606,3590173308334757754,524288 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4248,i,3484764309006328968,1825748169335847749,2097152 --field-trial-handle=1940,i,14657661429639839822,5857910910212885115,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ed54168e9bd9b049b307ad0198c8ff96fedc239690683bbbe954b5b6ccc78d1e
MD5 e13f095bcb4b9c0f4556bd8310cd4c8b
SHA1 6f2ae1857ed820a530bece8a02541eb1eb26db43
SHA512 391fa95533bb7b534e5cf1ef628f7178db1ff4a768c5f98f0211d091434bef89f8aadb2e77a3b24168c58577d469227622dd559bec9b2751e416ce9e380714f1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7N:fwUQC5VwBIiElEd2K57P7N
TLSH
T123B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b4af1239220c693beded24be105956a8e91870f0717617e5b283563dd83c681f
MD5 28557ce094475be79a6caf326d1cbf61
SHA1 0f1e3b9dd6337eaa0100d8daf4ea7a7a5b862550
SHA512 2b6c752f8e2ec4ac0caaf34c09f01e3932c5d850fdd0252ceb9a63745721bf9f8eb4977d6e4d1466f0c49991eddedcd421806cbe145806ae0f50a5a822f2d12c
TLSH
T15B71C374024EC663E3A60A3252E13337F1FF8AD6F6239E4A21608C762618F51821C7FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f7077247a0ce0509514946160bac6aa8e893eaa08958810901f68718a14a95e8
MD5 1ea9b6dfcef64570f855f198350fc8f5
SHA1 7db514f28616f1fdd270f5c54267994a16a00362
SHA512 5e76d9c5329f7ff160fe18c6ae429b2e6bc607593e39f70acba0bacd93401b7a886b81917e779dd4407334b6c2952048e1bc58270bcb6fcf691829bbce93f86f
TLSH
T1A2719475064EC663E3A50A7262D13337F5FF85D6F6239E4A21548C762A18F11861C7BC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ac1a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ac1a.TMP
Size 3KB
SHA256 5b7676839922c6718ee0ec48eb628049e99be2c3768aedf35a727270bcc8e653
MD5 e856334e0a8ad2adde9e6a80b98fed65
SHA1 eebe0c80a52b424fafb9047e81b748f59c3b7d8d
SHA512 b194323fec64c3456d79b5fef6b4968870e2756bf8bf081a9b943d924f04ba659b921763ba61f84e9e506e696a67d50d2a07f1d223972fd0f7da7af8678ae1a9
TLSH
T18471C575064EC663E3A50A7252E13337F0FF85DAF6239E4A20544C762618F11861C7FC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fb9e1cc1d6d9b08665ffc312cfaea372368b69b5bc9d00f9b2ab4750bd5ea8b5
MD5 e75caf91ca01dcbb610e839f65f8e2de
SHA1 41b27c3a0bc3169884cbad00ab072f3b2b7fe2e1
SHA512 66ba666caebaf34fb8f882f57a05b0c05b99c12d4e22fc742e52a4469365278e9c1e29c8b7b65c4a1f6d7ca7ab4b01148a36d460dc57c9d13d66c326eab1027b
SSDEEP 192:sxZl/yM/jK1Ml8MWOy/f1sl7N1nNdp+xjxXXHW6+WNzApAH5O/YIsEK5AIg5qRI:sxZl5uOy/f1sl7Nph+LHbkAM/qIII
TLSH
T1AA720A526A2489B7CCCAD208BD35BF53D6F504739A500E5C6AFCD91C04EA6FD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8c4f1ed4899dadd64317376d8b461230f3e83f479a83c01c6155c21182c3e80f
MD5 e000d27957b46217a3d2daa9b14801d3
SHA1 62ba688cc28d5dd06c127649deede3a45abae1da
SHA512 f808234bcf1dd2f75938af35fc8baf87ce09635f037ad9948d98b4ab038ab4fb94a5b27c766b3f4e7ae28672899b97dcff42afa980b6c14516013791b52cacba
SSDEEP 192:sxZl/yM/jK1Ml8Mky/f1sg7CZIdpEiHW6+WNz/t/YI3X5AIgrJ:sxZl5My/f1sg7CynHbZ/k9
TLSH
T14742F8126A346AB7CCDBD309F945BF53D6F91472A2900E54A9FCDA1C04E6BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cd4c899d6e4068a22603e53aad4daa63b4cad6f271454e9fc6dabcd12e33287c
MD5 909e1fa7f4722245eaed1d1e50dd957d
SHA1 cdb41f35ccaafaf429d5ee52e5df9901f1eb58a1
SHA512 9791cb5cd19205ae56d11a66feb7987b25876e0635344d16a75dfaa044c634e433456ca1cee7b30811c0a81c722e83269b9cb49882ec17448c59a425861b15a8
SSDEEP 768:6MsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR91roUE+:6MsqxXlWvJD6Tu1ja54LAs9OUL
TLSH
T13AD20B3B694CC77E4F840E5DEC266FD76ED801CBA6988D5447FA880C02CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a9092558f7806ece18e53eda7a804909beb12909cc94ca304a6f70d52c74c6c5
MD5 2fe43698daaf13bb992167515011d01c
SHA1 6db3846f5a13beb2186bc90d13e8559f2661e2d1
SHA512 fbc0f74d95c439e840498dfbd5a56451fb9b9aef1cab3fd2aa73abd97269c8eacb3355a935d50ea1962d2bb8387b6ee3b17af370f5210d347305994506bc6ee7
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTylDIRK4A0TyRCIfKPKcfyZ2IfKf6c0:KYbaKYIKeDaK4AKiCQKPKOK2gKf6P
TLSH
T1C3C12106327A1652383D2998B26685770F423AA3305CF47F7FB964A50F66E124CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6d73fbdce5de90624d27fd0e6a7aef8fbaf90ecf008fe86e08c96e4c2f33f146
MD5 35d68bf5224c3759ec45fb1de263f728
SHA1 b92b4b794e38d537f056c45eae6a4c87c41bb969
SHA512 6ed858887c5fe143050b78ca3555233fea2505f89fb8c6b6e4b8f6651dc236f0322f6ad3373ee99751fcef3aeb41943816b7db564ddd3fbac43cc331c173e4a2
SSDEEP 192:uxLsN1UQvkRbbXQmiU1JfQk4VRNA+Fd10JoLkGwPMSRGqv8U8:ssN1U7bVzIbVRNzdTLGwU8
TLSH
T173322A316C386C7B4EE2A545F44736139FF5506BAAC93F94D2EC5B0C01DB6AC231A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b6a7b77235612b1c090b8f66a6d5e101578be6b46a965415bc95e226bd7c8e71
MD5 912ce10e4c0769c3c7be0102e5d5ddfe
SHA1 3611e1e7f7c3f8a42ca3aac71f7076315b8f81c1
SHA512 e4fdae962164ce25a8f9017fee4b1aef14239502edc3327d32c2768d8a9e728fe19ca25e0a62d20867c9b680274a6662e91e8398aa19e3b6614398c92e6ba381
SSDEEP 192:utLsN1BQvkRbbXQmiU1JfQk4VRNA+Fd10JoLkGwPMSRGqv8Ut:AsN1B7bVzIbVRNzdTLGwUt
TLSH
T154422A316C386C7B4EE2A545F44736139FF4906BAAC93F94D2EC5B0C01DB79C231A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 91ec666ef932a3b2cd58e015cd9127ba7805a98ec3dd8d434f93ee6bcdd7fe8f
MD5 4f35bbfc092c40b860c21c1870497cb5
SHA1 4c5376062d7b011d039cbcc49fba27caa0fbfca1
SHA512 790cf3b368796a4f65e2f9442b1a1aed2e524483f1422b7d904d032e26059aba126ad3914d4db245a33ce7b5a6550e302bcc3b71947c5bba1dbd04d2bcb627d6
SSDEEP 192:tONx6JkRtQmiUy5fW+RNA+Fd10JoLkRh3xRRU6:tONx6Ur2W+RNzdTLMRU6
TLSH
T13002E8356C382CBB9EF26D4AB58B37135FE4216BBA852F84D6E81B0C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 632e846f78255ce3f7028b0d4e1b37f644e615ebf1d92aa12783b0a7e6c10a9c
MD5 f85bf2b34c4ebf0b89798c7d911781f7
SHA1 3ba38acd580cfe5062d123ed54f24bc8e5cf0835
SHA512 77c1eaacc85172c0ab78feaa1c3d0e3d89da08e2037ad1588ed4fc399346ced4c204a402e871f78c30b0fb83cdbd1d4ed7e873ba35f3d2231000c28b4f36fe3f
SSDEEP 192:EONI6JkRQQmiUyvXf5+RNA+Fd10JoLkGwPyVcGqv8U6:EONI6UQ8P5+RNzdTLiwU6
TLSH
T12B120B316C386C7B5EE26856F48736135FE5516BEE8A3F90D5EC5B0C01DBAAC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5d1cd2e47c7d08f1b10687220f3ffbe83785b15c3bd8a70696784c8072ba7594
MD5 134ce4566762b272c925b053ba4d3745
SHA1 2be67885e8a64cada300935b1bcc78719898bf46
SHA512 c9b03486599d67c616af57f1cd4dde51bbc669d1b58a8e32ab5c4b942954deae85e93a0bbfef367a92f4745056bcc1713d0b832b473e3d30118a1462bad9da35
SSDEEP 192:utLsN1BTUvkRbbXQmiU1J0QyOVRNA+Fd10JoLkGwPMSRGqv8UA9:AsN1BTXbVz53VRNzdTLGwUA9
TLSH
T1A8421A316C786C7B4EE2A545F44736139FF4906BAAC93F94D1EC5B0C01DB7AC231A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ce6b6afac3c88cac6791f7ac35c7d564489cb503c9d88d324654a0dfd5e01361
MD5 6b9ebeb774c5e0b22de455ffbdb8f36c
SHA1 5220bc3fd24b42987c3fdb352b5c6045a4a7ebf0
SHA512 58885a5f7413a534ed92047069706c1762525879da794f4bad3e8999a79b9cbbab3afc8e21ecafc8d8eb10c8f899d9bdd715301650837b4fab52913b4309ac6b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5948c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5948c7.TMP
Size 392B
SHA256 691bc807e8f07c045f66bddcd164c065de5d32e43e55dec57c36e309dcac649c
MD5 1576969210d89479fa6b077fda2dba2e
SHA1 4459b7ba28766bf7a1df67e52b338e9974f2db61
SHA512 9aaf37690d9ca0adf5ffb5457d2f1488e16b1ac8e7811e620a93a6137697695675fb4f07cb1e38a7ab2989e8fe57c1514c7313e3ad89b8aed9db242e12bcbcd1
MD5 SHA1 SHA512

Submit Download

706cd41e-2beb-4449-a96a-d09afa3e10d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\706cd41e-2beb-4449-a96a-d09afa3e10d5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 83437bc4a0138e81c4f894f27fde9039e366f03d3e66ce1d2bd8cbd134a83c51
MD5 37d28f6d73eb708035910d627f789d08
SHA1 8c29e79973ae9dd7009139dd01d857c045744d5e
SHA512 c7c670fc4a31296bb0f47e28a1f669c165c378cdc890e8563265ae16f924fbc119ac7af19b85fe5e895034dbe1a08e479e29c490e963f508bdff80db72d91afa
TLSH
T15141075DABE91108B3B7BE5AABF6A8AD447FB9772F07C09D00110D4E0A66A40D861737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads