c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f

Analysis

max time kernel
299s
max time network
313s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.7MB
Sample260810-3hdlws1dpg
SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
MD5 edaeffe92dbfd973958c9d2267201b32
SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
TLSH
T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2188	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308787536210618"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{B16BB680-9A5C-44B9-8D20-34B6C0393652}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 3496	4216	msedge.exe	82
PID 4216 wrote to memory of 2148	4216	msedge.exe	83
PID 4216 wrote to memory of 2148	4216	msedge.exe	83
PID 4216 wrote to memory of 2148	4216	msedge.exe	83
PID 4216 wrote to memory of 2188	4216	msedge.exe	84
PID 4216 wrote to memory of 1644	4216	msedge.exe	86
PID 4216 wrote to memory of 1644	4216	msedge.exe	86
PID 4216 wrote to memory of 2632	4216	msedge.exe	87
PID 4216 wrote to memory of 2632	4216	msedge.exe	87
PID 4216 wrote to memory of 2632	4216	msedge.exe	87
PID 4216 wrote to memory of 1132	4216	msedge.exe	88
PID 4216 wrote to memory of 1132	4216	msedge.exe	88
PID 4216 wrote to memory of 1132	4216	msedge.exe	88
PID 4216 wrote to memory of 3900	4216	msedge.exe	89
PID 4216 wrote to memory of 3900	4216	msedge.exe	89
PID 4216 wrote to memory of 3900	4216	msedge.exe	89
PID 4216 wrote to memory of 3120	4216	msedge.exe	90
PID 4216 wrote to memory of 3120	4216	msedge.exe	90
PID 4216 wrote to memory of 3120	4216	msedge.exe	90
PID 4216 wrote to memory of 3220	4216	msedge.exe	95
PID 4216 wrote to memory of 2080	4216	msedge.exe	96
PID 4216 wrote to memory of 3220	4216	msedge.exe	95
PID 4216 wrote to memory of 2080	4216	msedge.exe	96
PID 4216 wrote to memory of 2952	4216	msedge.exe	98
PID 4216 wrote to memory of 368	4216	msedge.exe	110
PID 4216 wrote to memory of 1960	4216	msedge.exe	111
PID 4216 wrote to memory of 4292	4216	msedge.exe	112
PID 4216 wrote to memory of 3120	4216	msedge.exe	113
PID 4216 wrote to memory of 3120	4216	msedge.exe	113
PID 4216 wrote to memory of 2776	4216	msedge.exe	117
PID 4216 wrote to memory of 2776	4216	msedge.exe	117
PID 4216 wrote to memory of 2788	4216	msedge.exe	119
PID 4216 wrote to memory of 5088	4216	msedge.exe	120
PID 4216 wrote to memory of 5088	4216	msedge.exe	120
PID 4216 wrote to memory of 1688	4216	msedge.exe	121
PID 4216 wrote to memory of 1688	4216	msedge.exe	121
PID 4216 wrote to memory of 1652	4216	msedge.exe	122
PID 4216 wrote to memory of 1652	4216	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc5d49c188,0x7ffc5d49c194,0x7ffc5d49c1a0
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,16230867816615219396,9189894362282664264,262144 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,5328263936810722082,5112909254860561461,524288 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,16727527886698472407,18438029831144836494,524288 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3380,i,1233828985816538492,7033195189912964716,2097152 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,2752803508675987650,3149458406322136008,2097152 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,17178535848279761441,247828916841715183,2097152 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,11272989457971760760,7045172562632014694,2097152 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,2426227614585720748,466657215652545548,524288 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,13991622691196734603,17159121389845739095,524288 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,17861163571181771786,6875406773405132490,524288 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,17861163571181771786,6875406773405132490,524288 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3316,i,14343672789068954030,7217039944514188467,524288 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,4697291162987820902,7951953744390694640,524288 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4104,i,10934727842417083292,52740023269031336,524288 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2860,i,12909954019643665295,11267814889216732165,524288 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,9245829150794889753,3908556166054224261,524288 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5844,i,15873676870439369362,18005405835952458496,262144 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,14833008422125181882,9151233742175612836,524288 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,7753346271815012830,8637683162932226529,524288 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,8153027511510561019,13405526233427597169,524288 --field-trial-handle=2036,i,12146717973588572086,13353481598192326660,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1652

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f191cc50a4587552f5e2704c507e9119011398e520435484a4de73208af7df19
MD5 9c01aef982b80cae250780d42a41f304
SHA1 d65d9a97acee74f4bc9ffb94bfb80da2145a122e
SHA512 4cc691dc9cdbd26fc9e2a5ce4c97afc1a2a72af9469db853da8c9fd145294df4340ecc130266baa828d0cb8ce8b3356af70bd1dcad90e0e28a10fae2953d4dcf
TLSH
T1D1E020C907DCC69FBA4065879155530EC285378AD2C5FA1E1764C4CD72099406A87950
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 8a631a68a3cdef8f6ca99c3ede2df384e15f98f5b25d9d2975152950136d01a0
MD5 2e753e0882b56868d3a3878f8dbeb323
SHA1 c63fdc399a26eb4b59c745a8b6fa7542e1f5bdd6
SHA512 33728db049bb6ba246a0fc24ac0cab374b3bdcd7e02cac1db8d8fb39003c34c53c84454827678ac0133e387712a36ab8bdc12068e48fdbb3679942bfc8310864
TLSH
T149E020D44DD4C65D7A806787A27C474C9290374AD6CCFA5D1754C8D870414C073C7950
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 95690ddcada771fc87c57125cc3f939bac3465414fe99099c78f72850728a23d
MD5 d57392a1a1d0a70c9138c454a06fc07d
SHA1 fa523e3e1cb18f4b6f567cad654976802ab46099
SHA512 b9a7d937c6fdf753f39c023c5703b62f1543415226e60ec6184b7591448992167fc385bc253f2bb5ed708d282de479bdb7ce4fbcab7eaa039dcee2496b439115
TLSH
T1F7715EB7034D14E3EB631D31ACC10AC678BA90EDF6377E961070DB35C52633141E9659
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58af08.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58af08.TMP
Size 3KB
SHA256 def41ce504ff402804b61edd1c142bea4c628b83f56d35a269b4aa6caae508e1
MD5 8bb8c9c8849287b24b74decd9543ad95
SHA1 509183e5c9f48cc5e3141b3846c090632cefa616
SHA512 b7f598abc0f36668fe778916eb332708d1ed05440bd93f2a3ae2911ca9c39edc5ed6287d03ae47a0208c0ffa283b0090318d890812c1a3105dd777278c095d38
TLSH
T1A8714CB7074D18E3EB631C32ECD10AC6B8BA91ECF6377E9A1060CB35C62633141E9658
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 66a0793cf5518ad7a0b37a07f063f146d4642607554c099df9fa4bab1c893cf7
MD5 ad01265b7b575780496dd6b12330b950
SHA1 c5af8ccb55cecdfa5242e01ba2d2ec4913ad377f
SHA512 3653e9508fe3678946330b03265d1e7086d52e22a70b656dc533ed0d045ea31d69c5275140cc2e2c029610525f0cea84a07f1be38b1538f978858843675f1c04
TLSH
T12C119CF3C3D5856E890516F06A28AE2BCE2D0606421C7C69C9D4FF6BD3E30B5E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7f98bbe16b4604932c6d1fa51ce09502bbd9884c47228dc5bb2d3a901f39a7f8
MD5 429576cb4f93cb14d5aac0ec95ae1660
SHA1 c80a6b64597c108f611a6e53a94446cd329932cc
SHA512 2f7d2ee372a1d7232500a5893ebebb2e88f3840afc0c6b51e0e849c0233b444309f3a07531c7cd7146899fc02d272e56bcf382796462fafdb6e731899a1c719e
SSDEEP 192:sxZ4BRDyM/jK1Ml8Mkb/fFswlH3V1Idpd6HW6+WNGYvrPjONfIgrJ:sxZ4BFMb/fFsw14QHbGAqf9
TLSH
T10B42D7116A34A97BCCCBD20DFA55BF53D6F90572D2900E44AAFCDA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1f5fca8d3ef2233c3c161dc2b498db4c4bf98bb0c8d528255157e4b7fe0513ac
MD5 96f38d74c921ac3840d808db22d193b5
SHA1 f41cc7d5667b25ba0900bf52353e2aa9240b5b67
SHA512 54a0712be72fdd0928d1e7204f7be0234e58255d42b9dd6e5e1e53734b4ee2574a3aef4f18bbca7c1176988c1f2f37a8fdb7f7a83ab1fda1170a2d11834649fd
SSDEEP 192:sxZ4BRDyM/jK1Ml8UQ8kb/fFsv7H3V1IdpH6HW6+WNGYvKSjONfIg5yJ:sxZ4BFqHb/fFsvj4aHbGSqfI
TLSH
T19A52D6116A349977CCDFD20DFA41BF53D6F9447292900E84AAFCDA1C05E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 68eff59a48544a896dc94cb1cfc67e6595bdac7935cf7fb0a05df48b303b4586
MD5 5824c3ac0f2c7c8e098926d5d5376c05
SHA1 f80df7638e85ec0a97540e6502e0c4851a7faba0
SHA512 53bcec17d79bc1e1f248e5d25e64e3d7e64fefab58c75644981a7da69458d2bc0a43b4b2ff7f71df1db1b116ebb62a2bb72fe074e3917c0fd40ceab9070dda07
SSDEEP 768:hxseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppyrocP:hxseJ3xWvhfynu1jaVcL88ppM
TLSH
T1FBD20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA980C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9e11f863fbb0f70b479d91cd991cd8063c6674d68deb53d99c9be7474f98a0cc
MD5 b055b10dcce23d043265714edb236d72
SHA1 e86b848e0efebe5334b621b748b77469bb75bc58
SHA512 d2583134e1195c88eb66332c3fa4ab73602f497ec848af8ba0fba6b29e0e53628fff56947506bd43a4a9366a9b771631f72d7e275f16a57c953fa6d12b2ef8a8
SSDEEP 48:KYHIhKggkXyVDIdKYMAPyJiI/KXq0Wzk1prU:KYH+Kggm+DmKYMS6i4KXqLzk1prU
TLSH
T1C4912706747A12023C3D2988B2E5D6360F4139637459A4EFBFB844958E67E214EFD8FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 eeeb844853eb2b40fbd7fd044125d2b6521f705534ef7446cd64b0e0ad76429a
MD5 47f4ccfaae61547c6154ec7ecd463b21
SHA1 11d7ad8c68b7f4ef09a608906be57fe0d0060831
SHA512 2b47fd831c92267aa50bcf6313a53630c521b0a5ee7d880855adf7ba5587db6cbc72396b850b6040353b7d355cfde923197ecb1e55230ce3e318be2f8757c28a
SSDEEP 192:uNLsNC+QKoKM7A5hQmiU18UaH4MTH7+FdLJxtQ+2+8z17cq2UMZ:OsNC+FM74/8Y9d9xW+2/7kUMZ
TLSH
T174424C31AC349C3B9DA7B185F04B36139FF4516BDAC46FA4EADCAF0C00CA65C130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 45bafc4134e6e15f6bdf70cffb3e23b557c29d0e2a887da41e9d14304bf5ba80
MD5 ff7a47bfdc2ae696f7f0e976a1e2752c
SHA1 9ff778c8c22f833e4bc3a73c293ca5a5042d7f25
SHA512 e751e28c7be954d0691c55e5ee4ba6374038469ba8f699eaab653240246b2cc9bb10ecd1c12bddb029b1c0da1a752cc6d86bb9be7acc3a2d2cc6f9d5f5a1aa31
SSDEEP 192:u2mm+xasuheOwQxMlwozsNCUQQKoKM7A5hQmiU18UaH4MTH7+FdLJxtQ+2s8v17O:lZcI4zsNCBFM74/8Y9d9xW+2h7kRn
TLSH
T1ED725D719C345C7BA9BBB146F48A36135EF8902BD6C45F94E5EDBF0C04DA668130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d796ce2218720218a652346f2ea55fb0b6b70f859690976303c8c3fb8824ac6a
MD5 3a2279c26712d396a83415ae87e71138
SHA1 27797f3bca3df077464bebc836172a80b38675ec
SHA512 b724f49df0a66105a87b60e6f31e7f487b3a2ea1ea2ec706f7e25431e824b274c545f443a58a71887cf743dbf8124040fa9f5619f74849df3e4176c4ac6a21e3
SSDEEP 192:lONP6vMtPQmiUymULThTH7+FdLJxf8477rLU/u:lONP6UtR2Tmd9xH7nU/u
TLSH
T1EC020835AC786C7BAAB3AD4AF48A37171FA4116FA9905B54EAE82F1C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 583480db818f65d7cc5862319499bd4966dca872e58652e6b5610da3097eafb8
MD5 49adaa5715f3b5e9523e866a2216be18
SHA1 0b247ca1b6540b0856a7e0c301f93e8d7bcdaafe
SHA512 4e02a17126389d7b2b96b8572707b35e14b887cbfee2c99662467eb7c20fbb4a953b33af8f6e195fbe0165155bb553c065b9543ee57aa3e704d80fe8e49cba18
SSDEEP 192:udm+xasuheOwQxMGsNCUQQKoKM7A5hQmiU18UaH4MTH7+FdLJxtQ+2+8z17cq2Rn:7ZcIhsNCBFM74/8Y9d9xW+2/7kRn
TLSH
T197626D719C345C7BA9BBF146F48A36138EF8902BD6C45F94F5EDBF0C04DA668130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 bf02231052bfdb0146c4996f9c00276dfde80215456b47aa477bd68338ca58b2
MD5 db30d94956c3a61c59120edb4fa9ac28
SHA1 5eaf263f8f3cff8910eae4c21bd99c3aeaa08572
SHA512 7b3f767026d4e9c556708dfd8840758c70aedd9aa334c35facec1a93ae989fb7dd0e9908fa20df6d33b23e560828bdec5c4dc76ef861e170db8243d4cf2898a6
SSDEEP 192:2OND6vMHPQmiUyVULohTH7+FdLJxtQ+2880I7cq2U/u:2OND6UHRPomd9xW+2B7kU/u
TLSH
T1B0120B31AC649C6BAD63B546F08B32174EF4926BDAC55BA0FADC3F1C05DE65C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 c9288afcfd5108902d66ce613277b386b74ba31a3817d2b0d23d1dbcd8fe4d93
MD5 ac1ce285c1665035d6fcd566b0135a42
SHA1 245df17f1b08102ec27e18f6f4896aa345a5b9fd
SHA512 43bbd56fdc5d693f52cf22fa4580483500c8db4aeaeab7ef8aa80d584a80978be3937566c7cb0687cc514ec6fb349e474969cf224899892ce00fa57eda42489c
TLSH
T1BF51398105C122FFADA66BF05F018889823FBA4BB1E9E8CF98D48CB42573C5745C10B4
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fa1bd16b2112d3c980bfca0816807b6de1fe715403f1c7a8bf9b33399a9e41bb
MD5 b0788dabd028bd4e6a6205c0bccb5f01
SHA1 fe812cb2fbcc45ab2cc129bf622ca7b4c6754d77
SHA512 311ad3620da2985f8d23946df6c88333d22b4ab667bb9e59486e204640969089280b7d63e92e9776ed85941346454efe980ddc5f79795ee49aaa211ef3acf509
TLSH
T10F41EB58AAF91148B3B76F5A9FF7A86D487EB8732E06D55E10110E4F0A33A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download