f5bdfe26f2bc60374737b2049ba6987c28130cc2943ad57a58e26ddd31b29f54

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260809-phn6qs1sav
SHA256 f5bdfe26f2bc60374737b2049ba6987c28130cc2943ad57a58e26ddd31b29f54
MD5 6cba9889e9f8f4a7b0b72722172cfa17
SHA1 c32d958cbd0706df9ea5687a779ddcce45b1fdb5
SHA512 d74447a6691a47b5f1e8e057f989335b4a2a86ac0291b5bbc07e8cefcba5eee0592e269751f16de14ec49693a81a94cce6e9238b718154cc92931f43b0a447dc
TLSH
T15951B9117F10559373F187B7A82EF275D35DB64A4B404386F9207CD23604A23A8936BA
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3356	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307516036834436"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{448329BC-20A2-4E3B-80F6-B20BC6A0D161}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 1320	3244	msedge.exe	85
PID 3244 wrote to memory of 3356	3244	msedge.exe	86
PID 3244 wrote to memory of 2404	3244	msedge.exe	87
PID 3244 wrote to memory of 1272	3244	msedge.exe	88
PID 3244 wrote to memory of 2404	3244	msedge.exe	87
PID 3244 wrote to memory of 1272	3244	msedge.exe	88
PID 3244 wrote to memory of 1272	3244	msedge.exe	88
PID 3244 wrote to memory of 3920	3244	msedge.exe	89
PID 3244 wrote to memory of 3920	3244	msedge.exe	89
PID 3244 wrote to memory of 3920	3244	msedge.exe	89
PID 3244 wrote to memory of 3084	3244	msedge.exe	90
PID 3244 wrote to memory of 3084	3244	msedge.exe	90
PID 3244 wrote to memory of 3084	3244	msedge.exe	90
PID 3244 wrote to memory of 2328	3244	msedge.exe	92
PID 3244 wrote to memory of 1276	3244	msedge.exe	93
PID 3244 wrote to memory of 2328	3244	msedge.exe	92
PID 3244 wrote to memory of 2328	3244	msedge.exe	92
PID 3244 wrote to memory of 1276	3244	msedge.exe	93
PID 3244 wrote to memory of 1276	3244	msedge.exe	93
PID 3244 wrote to memory of 3024	3244	msedge.exe	94
PID 3244 wrote to memory of 3024	3244	msedge.exe	94
PID 3244 wrote to memory of 3024	3244	msedge.exe	94
PID 3244 wrote to memory of 2932	3244	msedge.exe	98
PID 3244 wrote to memory of 2932	3244	msedge.exe	98
PID 3244 wrote to memory of 2932	3244	msedge.exe	98
PID 3244 wrote to memory of 2488	3244	msedge.exe	99
PID 3244 wrote to memory of 2488	3244	msedge.exe	99
PID 3244 wrote to memory of 2488	3244	msedge.exe	99
PID 3244 wrote to memory of 4808	3244	msedge.exe	100
PID 3244 wrote to memory of 4808	3244	msedge.exe	100
PID 3244 wrote to memory of 1504	3244	msedge.exe	101
PID 3244 wrote to memory of 1504	3244	msedge.exe	101
PID 3244 wrote to memory of 4104	3244	msedge.exe	103
PID 3244 wrote to memory of 4580	3244	msedge.exe	104
PID 3244 wrote to memory of 4580	3244	msedge.exe	104
PID 3244 wrote to memory of 4580	3244	msedge.exe	104
PID 3244 wrote to memory of 4108	3244	msedge.exe	108
PID 3244 wrote to memory of 2336	3244	msedge.exe	109
PID 3244 wrote to memory of 1088	3244	msedge.exe	110
PID 3244 wrote to memory of 3944	3244	msedge.exe	114
PID 3244 wrote to memory of 3944	3244	msedge.exe	114
PID 3244 wrote to memory of 3944	3244	msedge.exe	114
PID 3244 wrote to memory of 724	3244	msedge.exe	118
PID 3244 wrote to memory of 724	3244	msedge.exe	118
PID 3244 wrote to memory of 2376	3244	msedge.exe	120
PID 3244 wrote to memory of 2376	3244	msedge.exe	120
PID 3244 wrote to memory of 2376	3244	msedge.exe	120
PID 3244 wrote to memory of 4924	3244	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb1433c188,0x7ffb1433c194,0x7ffb1433c1a0
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,9868668019070023829,9689100428831317347,524288 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,7549660275748761582,17885370260643772258,524288 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,15663790606958126928,16670565552920645706,262144 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,17749410803705603,1329357967433884215,2097152 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,13147367322342120562,16272178353398110182,2097152 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,12509550104460126983,6288190018598250014,2097152 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,10037845887425533466,13298768075700228781,2097152 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:2
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3572,i,13550079760464195014,16717082001981607843,2097152 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5176,i,2811280371433379159,3620438443228172669,2097152 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3512,i,5460304562986734769,12826325474058070093,2097152 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,17019276729147950559,12372158252498117367,524288 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3388,i,17596858129104771380,4255266530684256540,524288 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,12781859393232778224,207994534419627885,524288 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,12781859393232778224,207994534419627885,524288 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5176,i,12488578992278456548,8183230683904168956,2097152 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,18395127029829720307,8357317420267694939,524288 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,2538180539222706995,8675425654617809461,524288 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,8485083832887830064,14641925940615899945,524288 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=2640,i,11823923794344890231,16431747683038176464,2097152 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,4745693933686486220,17388698155086057722,524288 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5700,i,16983717249206807964,4461842298762896627,2097152 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6628,i,13006607774084095348,8814571298515682429,262144 --field-trial-handle=2296,i,3429730334665273257,972064140629350681,262144 --variations-seed-version --mojo-platform-channel-handle=1676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 940d17921bde8de627e1df6a2514c8b3fa162d125a077e8179f39b5b8c9051cb
MD5 8f1976d278f5f3878b71e37366030520
SHA1 2e1a106c74408bccb299bfe5d6c47bfc6830d443
SHA512 8bfb55b62052ebb4ad84ddc2856f84c4fd88e93032fd4fe6b83405a4748dfa127f9c01d819995bc08a7b34a940622e650868f0b9546ac5df1bc6c24f7018fd3f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T1FAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8960d758df9672f0eb01ae6815412d8d8cafbf2f4ddb32448868388c1c316c24
MD5 5080937d940d47b251d21b0fe652a349
SHA1 0c7f50c4c7259794caad76f7249b930433a00f4f
SHA512 4a09cd8e37d948119cd58d6d981e310be8276c567df73eeb40deddd90146c8f83823c133bfcee41b2f25afbd6c055cde8e7c3015bd6c3fbd2ad44be11aa750e7
TLSH
T1B9610B380262C85CD3AC153CF1D15234747F859A9A1B6E652E14BFFDE9CAB31A1D6C0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586925.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586925.TMP
Size 3KB
SHA256 0767b97690552ea58b568ba11460e8377f169c5e24afef3c0446948ac18fa4ad
MD5 057a27e7a4e08c03e5438fdf975cac4c
SHA1 ed3a3a5a64098dc787f05fd6c3b4e5b769a67deb
SHA512 d0793b4ac3408f51e4bf055fb66254be5220eb580fe8fd761b8aa3605aaa7832c0776e3a4919469c04b5caaf541994fd423951158a01213790c3ce1729dcb548
TLSH
T1A7610C380262C84CD36C153DF1D11234743F868A9A1B6E652E14BFFDE5C9B31A1D6C0B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b68227bf12abaf18ab3b693807e2cdb1409bfe3f742f8637e9edc4083d3ef5d0
MD5 236eccd192f1418c8307d3f3af5d1f51
SHA1 884e8678d80e65aaef8a8d862be83c28dbb39a2f
SHA512 97514f71491459e5835006a76f663afb3ec3d7e0f356297d055e4564bf4ec4d22e575cd4655ef8a506c983fc43d9a1fd121377e13abd4a967e6500eb32953e23
TLSH
T18A11ADF3C3E5856E8A0556F09A18AE2BCE1D0606431C3C2AC9D4FF6BD3E3475E00155B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 72a91c12e3e0af376ebe62c9f9d7396e4cf5a1d22fef81c18a2f55a6e1e4b7a7
MD5 985e1c63cf5da83c74a24fac9a609412
SHA1 7e8cbca21593a4caf2d39527b240d90da4331f9f
SHA512 8d5e94a44a0a8f275703fe78482e2fcf93e786f5421dc12f431c4b85fa318b404ac2c2f54d0544f45c73f8e2a00a6187b3dd6d453fcee14384906f0960040012
SSDEEP 192:sxZvReyM/jK1Ml8MkI/fzsmzPSgLIdpdvFHW6+WNGYHj9qGmIgrJ:sxZv4MI/fzsmzPSgUDHbGF9
TLSH
T17542D6116A346977CCDBD20DBA557F53D6F90472A2900E48AAFCDA1C04EBAED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c39519567a28023d2817145c590af13264c0567dc7359797d89109e48b16e309
MD5 ea6a609f9627dc890ea40f214245dae1
SHA1 df7b321afa2af244e9c2d89dd2ec079e083c61fa
SHA512 9ae8e0a682c78e233e518734d4120e2e1fe51897aaefd9dceaf075cbb86b6001e892c675aecd0bbc592fa7feba64c851644cf28e94dc5b4ad277d83e5a5f80c2
SSDEEP 192:sxZvReyM/jK1Ml8UQFkI/fzs+zPmgLIdpHvFHW6+WNGYHHwHGmIg5gJ:sxZv4qOI/fzs+zPmgU9HbGpS
TLSH
T1D752D7166A346977CCDBD20DB941BF53D6F94472A2900E44AAFCDA1C00EBAED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b93c0204a01847e91db033aa081acb2ef44fa6a22b56bd61d9de5ef8612beea8
MD5 7f5990da36cc6c7b72b9c52ecfc2dafb
SHA1 1717e1aa7826b81478e9e5d3774aa3a72a31adba
SHA512 1beb2d58c6d346301edf1acaf8d2b38635bb711866dfebf22d4eec8b5458cd7db3804a370d765f4699fc36e23a32f2d1720f698b34da5f109dd597d4b2558e7a
SSDEEP 768:BwUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RyroV1b0V:BwUZYTMWvg0Pou1ja7eLZmRpQV
TLSH
T120D20A2F280CCB7E4F844E5DEC2A6F963ED801CB5A584D5447EA884C02CB7EF512A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 b4f2ed71f2dd983230a84a3a62ad006b5efe22fc90a8f8281acc5945b784eb03
MD5 3f77dac4ab69d92cc5483c311b7e8697
SHA1 c707592bfff8d8ccf801162417d2b2930bd15efe
SHA512 7ea9e259d4d0f0794b4e5208a2b8fcecda2519c86bfb3003744ca6686636ac724e5637692161c62b8926f2a28eb0129b895be426bb4e8865311977d721ca020c
SSDEEP 96:KA1eK2AAv+KAgmiSgKXq8OgKXqSeGbg0GwQxFU1sDsxKr4DmxH+2NsgM:EU1HQHeGbg0GwQHU1gsK4Dm9+2Nsd
TLSH
T177E1066272BA02423D3E67189295871FCE4272633018E52F3BAD41B18E67D628DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf3b57e0-73bb-41c3-aaa0-9962b8657ed8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bf3b57e0-73bb-41c3-aaa0-9962b8657ed8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 acb027eaa71605320138d0688517fe3877ae895ae2227c39a93f01a1c0b47cf3
MD5 004c8b2ab94b27138d22aa6fb8d85b9d
SHA1 43253d367faca91266e05f299a068b29790218cd
SHA512 04479cea834d4232c93f25d13830b611356552efb16f12a9a59757cd61f2b78523888735aad3376a75b44b0424e9d859c89ee58688036cf847d8ffe4d4bb8b89
SSDEEP 384:FZcIhsNeqHBe6FCSzX5od+hO/VuXd+2ATnTKwBODNZOC3KDW:9hGehmOgO9utlATnewBKZO8h
TLSH
T155926D72583C9C769EE6E559F84736178EF850B3E6C82F9491ED6B1C01EA69C130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c5c2f76596dde84ba429b753d639230be1a395bad633175ccf4b607bac4ebc37
MD5 f864b2a644f869fb6f7cda069a4fcdcf
SHA1 a8092a5e94fd9d91b408767d6b2632cc5ecb4964
SHA512 202166f1ee43149aea62cafb8a1822318f79a9b72c3eaba380f3d5aa876160971a32d54879d6f740d9bd94b1a889dd0e8180a0b4ce1890cb1d2591fee8d7f9f0
SSDEEP 384:TZcIhsNeHHBe6FCSzX5od+hO/VuXd+2ATnTKwBODNZOC3KDW:Lh3ehmOgO9utlATnewBKZO8h
TLSH
T1A8927D72583C9C769EE6F559F84736079EF890B3E6C82F9491EC6B1C01EA69C130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7c64087d3a93d5eedd616d974ea3e4359eea60fdf4e332f8d7a70f83de189e5d
MD5 e54d126140480a869e04fbce15604842
SHA1 90bd6c56ab064173250ec53732f14c2da47c501d
SHA512 08297ce0c165d3c9a5feb97bbf4b01c6b92fa58704d0129eeef1d8bd30cdd221c457c2a817289df4f38180f33b1db85c4e33771bf090835949e332d1779d5556
SSDEEP 192:yONw61VWQmiUy2lgGX5Obd+jFO/aob/aL36iU6:yONw6WxgGX5od+hO/V+eiU6
TLSH
T12502D93569286C778EF2AE49F58737139F99206BEA542F84D6E81B1C00D769C2347C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 269a864d49342dd9b52e9beb4670bd3af5338f2bd37ed5a549121c09adbab465
MD5 35a3c87a82ed1a46ee242369b193412c
SHA1 c4fd6dcc39b8f35924cbe1a009f387dbe285b36e
SHA512 749410785596291025c91f16eab7ac8ac9efd6253f9f5db490f8ea6f2825679b6bf7cc822132409d0486f2f8bf6406366c43f0bc8ffa71b17d99e97f61fc7fd4
SSDEEP 192:OON/61rWQmiUy6lOGX5Obd+jFO/aouJFd+2PjJNqyU6:OON/6gxOGX5od+hO/VuXd+2tTU6
TLSH
T1BD121B366428AC775EE2A595F48736538FA95167DA447FC0D1EC2B1C01EB6AC230FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 491c446515e38a6c5a825ce1e9f3b4075f05b4ae776262283cf31cabce428ee0
MD5 fab22a51e78014859f1fb9de01a7b960
SHA1 d921ac8428df2314b32cf369e0d7e9f5baf3cd8a
SHA512 88d9b6e77440b31cdc686c0de2f00732dcda1f529de8f2a5b1251ec49a02625b99066337ecf18c7aeb8d13b6c298880ba558871a1aca9474777e6dac36a33012
SSDEEP 384:giFiZcIXzsNu8TUNTUlIlHHBe6FCSzX5od+hO/VuXd+2QTnTKwBODNZOC3KDW:7FQD/wgXehmOgO9utlQTnewBKZO8h
TLSH
T17EA26D735868DC779EE6AA59F94B32078EF850B3D6D47A94E2DC6A1C00AB5DC130BC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23f35fcd-4421-4d76-a2f5-5e305f8e5d6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\23f35fcd-4421-4d76-a2f5-5e305f8e5d6d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a42274004fe8c7672d5a1a7d3e65dbc118e3e64480cc1ac24001df3c09aa79cb
MD5 ae94bf6bbc03dd46bafed1790a98f4e9
SHA1 0a6949acaee34a156b56cde95cbeee2c39b6f386
SHA512 0965e0d685e265179a85e823fb97578a82dc3c7c9a6e97315d1630043640e012c5e2295ced73ee1233106140c6e55b92c05f59aecf42dbe2b2c646c0a1e973e1
TLSH
T16A411858AAE91158B3B76E5AAFF6686E483EBD772F07C05D10110E4F0A22A40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download