Resubmissions
18/08/2026, 03:15
260818-drw26awtds18/08/2026, 02:59
260818-dgslzsfa921018/08/2026, 02:57
260818-df242avcnd116/08/2026, 12:55
260816-p52eksyvdx3Analysis
- user interaction
yes - max time kernel
163s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 12:55
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
900 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Errors
Reason
Machine shutdown
General
- Target sample.html
- Size 294KB
- Sample260816-p52eksyvdx
- SHA256 7b0c6a009f135396dc2525e2d076a507a83cf929cb378a2d4358a096e5e7f554
- MD5 1e138056b63e892e569747332f9fffd0
- SHA1 88a562f3312dc80482bc7a70f32fe93f4df78eb7
- SHA512 8de2fc298ec9f93b9d919a05e05adff4eaaa4c3f6a03267af709550489ff6306664bfb69008f8a8ac4cd4e50816fbaee94e091e9fc23549c8e9a16dc4a5037c6
- SSDEEP 3072:XX+NCyzqMwL4bIdfr7enlkqLH5Tj1byU0AAIRWXFhy5YqFR:XX+NCyzq5L4Idf5qLH51WYAIuRqH
- TLSH T12B546C326300B43BA817DDA0A6BE6F4E3C25E12BCC1647F8A595E530DFD2EB2151A71D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4916 msedge.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313585518320463" msedge.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{1A32E178-E745-4EDA-B069-875982B3D6D9} msedge.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 3136 Process not Found 4020 Process not Found 3412 Process not Found 3908 Process not Found 768 Process not Found 3728 Process not Found 3356 Process not Found 3852 Process not Found 4396 Process not Found 4588 Process not Found 4608 Process not Found 2456 Process not Found 2028 Process not Found 3868 Process not Found 1456 Process not Found 3692 Process not Found 2132 Process not Found 3912 Process not Found 2128 Process not Found 3296 Process not Found 4892 Process not Found 1184 Process not Found 2772 Process not Found 4200 Process not Found 1936 Process not Found 3932 Process not Found 920 Process not Found 576 Process not Found 116 Process not Found 360 Process not Found 872 Process not Found 3756 Process not Found 2320 Process not Found 3480 Process not Found 2496 Process not Found 3200 Process not Found 2224 Process not Found 548 Process not Found 2492 Process not Found 1592 Process not Found 3604 Process not Found 4456 Process not Found 3680 Process not Found 3724 Process not Found 3020 Process not Found 3708 Process not Found 4244 Process not Found 3092 Process not Found 3772 Process not Found 2244 Process not Found 4836 Process not Found 2316 Process not Found 1892 Process not Found 3760 Process not Found 2572 Process not Found 4492 Process not Found 3240 Process not Found 2844 Process not Found 3460 Process not Found 2848 Process not Found 176 Process not Found 1068 Process not Found 2068 Process not Found 1452 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4164 taskmgr.exe Token: SeSystemProfilePrivilege 4164 taskmgr.exe Token: SeCreateGlobalPrivilege 4164 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4728 msedge.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3504 StartMenuExperienceHost.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 4728 wrote to memory of 3836 4728 msedge.exe 86 PID 4728 wrote to memory of 4916 4728 msedge.exe 88 PID 4728 wrote to memory of 3980 4728 msedge.exe 89 PID 4728 wrote to memory of 3980 4728 msedge.exe 89 PID 4728 wrote to memory of 3528 4728 msedge.exe 90 PID 4728 wrote to memory of 3528 4728 msedge.exe 90 PID 4728 wrote to memory of 3528 4728 msedge.exe 90 PID 4728 wrote to memory of 4332 4728 msedge.exe 91 PID 4728 wrote to memory of 4332 4728 msedge.exe 91 PID 4728 wrote to memory of 4332 4728 msedge.exe 91 PID 4728 wrote to memory of 2400 4728 msedge.exe 92 PID 4728 wrote to memory of 2400 4728 msedge.exe 92 PID 4728 wrote to memory of 2400 4728 msedge.exe 92 PID 4728 wrote to memory of 5072 4728 msedge.exe 93 PID 4728 wrote to memory of 5072 4728 msedge.exe 93 PID 4728 wrote to memory of 5072 4728 msedge.exe 93 PID 4728 wrote to memory of 2884 4728 msedge.exe 94 PID 4728 wrote to memory of 2884 4728 msedge.exe 94 PID 4728 wrote to memory of 2884 4728 msedge.exe 94 PID 4728 wrote to memory of 3332 4728 msedge.exe 98 PID 4728 wrote to memory of 3924 4728 msedge.exe 99 PID 4728 wrote to memory of 3332 4728 msedge.exe 98 PID 4728 wrote to memory of 3924 4728 msedge.exe 99 PID 4728 wrote to memory of 416 4728 msedge.exe 101 PID 4728 wrote to memory of 1880 4728 msedge.exe 103 PID 4728 wrote to memory of 1880 4728 msedge.exe 103 PID 4728 wrote to memory of 1880 4728 msedge.exe 103
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffc1b7ec188,0x7ffc1b7ec194,0x7ffc1b7ec1a02⤵PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,17484867523917152490,11850671520101749543,524288 --field-trial-handle=2264,i,6701926631390416573,3968084154878944805,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:32⤵
- System Time Discovery
PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,11488044388904484360,5506685113024663480,524288 --field-trial-handle=2264,i,6701926631390416573,3968084154878944805,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:82⤵PID:3980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,11579733012303980678,10132176587028775192,262144 --field-trial-handle=2264,i,6701926631390416573,3968084154878944805,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:22⤵PID:3528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,2390556856618267033,629854280729471536,2097152 --field-trial-handle=2264,i,6701926631390416573,3968084154878944805,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:12⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,5301517622848324318,3605689563506777534,2097152 --field-trial-handle=2264,i,6701926631390416573,3968084154878944805,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:12⤵PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,4588969115938070531,15527601843968370348,2097152 --field-trial-handle=2264,i,6701926631390416573,3968084154878944805,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:12⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,16133404067847339712,8774702141158658369,2097152 --field-trial-handle=2264,i,6701926631390416573,3968084154878944805,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:22⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,11730568882184633526,130178324061723914,524288 --field-trial-handle=2264,i,6701926631390416573,3968084154878944805,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:82⤵PID:3332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,3307429495234632068,10767066135974843300,524288 --field-trial-handle=2264,i,6701926631390416573,3968084154878944805,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:82⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,4986433958823637334,424915840016788772,524288 --field-trial-handle=2264,i,6701926631390416573,3968084154878944805,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:82⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,4986433958823637334,424915840016788772,524288 --field-trial-handle=2264,i,6701926631390416573,3968084154878944805,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:82⤵PID:416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6168,i,14802792754607026622,2291897699032264859,2097152 --field-trial-handle=2264,i,6701926631390416573,3968084154878944805,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:12⤵PID:1880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4192
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4164
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3504
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1992
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1880
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1948
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4224
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4004
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 7fea608921203501a32578700c621171014c39e7f04c689721b0273231fb7a5f
- MD5 4e09ea0f719ca97c7b586b8e5f4d33a6
- SHA1 41cd00b43529d6db5a55ee3d9c51701969b4ae7f
- SHA512 959b767f8802a57cc6718b453cfb6eeafdf5379bee04e4db88bc742c90eecbc3233883deaccfe96dc2c0e83d6dbcb393b791c5666948b6c327c2f22803e8fa66
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
- TLSH T14EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 03c9714ceda41208919b91db8014de24ae37606ed2abc96a2531b3653937df48
- MD5 8c2296de8b61220530f453b2f30415dd
- SHA1 2c66c88bc6a0f8267af3c1881fe9195ca1582177
- SHA512 c741a1ee72d19a8af3a3823ca6df21b2e3afeeede73da7c80eb421ce9f7370fb162d00a8565078ba3856a8ccf78493a4b12f92955afe287b59ec5f2dc6911402
- TLSH T1E7D023307A3671C0C21E0030E4110B40236E40B230CF43476194440DADB40C1D2DFEC7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
- MD5 1656a3560c7aeae221756f3891b89fd3
- SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
- SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
- TLSH T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 257b8a2045b5cad61aa8107aa6eb4e1cc1969a2a93a6a47d5fb793dde23841bf
- MD5 7f8c3b0084c4721bffb02ed81d2c7adc
- SHA1 cd25645888029164d65d8d22bdd49b484a2a8db5
- SHA512 cc4ba4352e18422f8f8ee13c785eaeb707029e2068d47ae94afa846aea7300e45dee34eedccdb67ec9afff93a67e39b9881c1c73e4a027ee21559d66bfc9efcd
- TLSH T1366162F8C44207E0EF5270B283DB462F76F082F8F913BE8190E42B796B0676186CB158
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 238858c762058810f5d55a462705ccdd22c589483b96c9bf8d4916ecaa113e45
- MD5 025013a2d96ed87170cca29aadc28a18
- SHA1 55655c4fa7d77f298a16f8a9bcdd1e2825e911aa
- SHA512 71ad6c811ca2cea859d9646aeead1a6ba457ed3c32f218dfaa2f2716d406340ae3b0bf66daf090884f4bf33651f20288bd14fdf243cda7cc5a2516be8de31a6d
- TLSH T130417BF7C3D4867E880156F09A256E2BCD2D0A5A422C3C16C9E4EF5F67E24B1D24269F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 bdf76cafd0c84ca08b00a22bab6e86014662176fbb0633f2bd53d6dae5b84b7e
- MD5 ccea38cc7f03c619c029c9fbf3c862f5
- SHA1 09861790ac3a5f55164f970353698c85857d887c
- SHA512 f7d42d2ff1ab8ea14fb204d62a229661a39f78912b18920e3e98e6f4b95898080bb5aceebc5a56f8e1d3c4683786cff49f77c4b00b4e611f12a065f39aef342f
- SSDEEP 192:sxZFRbyM/jK1Ml8Mk0/fOsD/u51IdpdtHW6+WNGYzQcnkIgrJ:sxZFrM0/fOsD/uknHbGD9
- TLSH T1AF42E7026A34A977CCDBD209FA457F53D6F9147292940E48A9FCDA1C04E6AED2207C1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 51db1346bd41a3e32bf566d5ea209eeafccec003625feec36921b2bd42fe8015
- MD5 33fa9d961c48fcb442555548b97b9f34
- SHA1 9f22e06990a51c0808e832e17dcc24936eb68364
- SHA512 450e07f7970ba66df103597f93df7cf74050f1331f9ce707ca2f27acd0cedfc4c29ed096023fcb8b3db4928c3ffe8c3cb4462cce11f5592ea864301903c92b12
- SSDEEP 192:sxZFRbyM/jK1Ml8oQk0/fOscWpVt/uD1IdpdtHW6+WNGYTmpi6IgFJ:sxZFrDj0/fOscWvt/uKnHbGPv
- TLSH T18152E8116A34A97BCCDBD209FA557F53D6F91422A2900E48A9FCDA1C05E7BED2207C1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 30KB
- SHA256 5d8bf350a305493aeac312f148b2330f9163e24a1a4d4b5c0b8d43884c11b2c9
- MD5 fc4d6498d6993acf187af848a6bba459
- SHA1 fe26462b0faa79e657aefdca0c5a743e7549fba2
- SHA512 b4c588ad63c3fec0263f983ce9ae9621202a1290d7d6715c3a45f4c29e9641c328c9c15c73acd5cc33044c7cb1808092b17c14ad56c63747f26796c26fafb4c3
- SSDEEP 768:MzW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjBroIBibYV:MzW7kf0Wvqidau1jaa5LA3j6WV
- TLSH T197D20B3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EB51175DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 5KB
- SHA256 acaf242a933a8083e5feeedf88188320a5e294c6520606b3d2d47a2f8235bb9b
- MD5 0c704711ba859afec7c0b96716238931
- SHA1 2bfa3f5cd96aa166be64718585c42b330f20de9d
- SHA512 c7c0ad4a444d7ee64b52739f6e9348ddceb5b56ee2167843447f9fd98811a9caf692c897f0aed2ee92eae804886a455f98f33fc10a64cc0786147910060a6cef
- SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTXjIBKM4MHyhkI7KRS8jydrIxKkIc2:KIbCKcXj+KM42CkIKRSCOrWKkIx
- TLSH T1C7B142663237060238BE2D6CA69E8A779E4236633458646F7BF801651D27E121FFCCDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 204c142084c05f0bd6ab2d80ef0114f1e8377442b597a64cc294380d729e0e90
- MD5 913bc7dd3aa96a06494c53323a56bc0e
- SHA1 3baa1991c9083d939a37a3a560ba1ff6fde008f1
- SHA512 37336b3ba11f127702487f94a3328e620edd0fe252da2db838244bbbb2aa91c0adc60ad52bcfa0e6887f90642f800041cca406d0dd8c1c121f10a9c9b4fcd227
- SSDEEP 384:wZcIhsNtmy83bXuQDdmmaHCEJrWQ+OOPrXLpe8C/9BQ:OhOU6aIhhWdOi9POQ
- TLSH T1F5928E719C345D67A9B2F642F58636035FFC503BF6C42B88A6ECEB1C05EA6681316C17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 25KB
- SHA256 5aa9c064668c5d06cbeb019cc4b7dbb00a5375142829c73d4937aae3cde83189
- MD5 1995008a0857ba88eeab74856da7d899
- SHA1 df0a8a7a058b79416d1bd65a30e2dca438fde12e
- SHA512 2b426a61b16e4a117bc2a1c88d51ed161c73e547f2241a1dafc483ae96ff0982c5054b935edb9593c8d9312c594a589d1695ce9568f3e465dd18a35afaa04656
- SSDEEP 384:4ZcIhsNtmy83bXiQDdmmaHCEJrWTwA8tvn1okOK+Y4MkWOOPrXLpe8C/9BQ:GhOUOaIhhWz8YvK+Y4MkWOi9POQ
- TLSH T11EC27CB0D8B56DE754A5F5C5AA82E2136DF8103BD6C84A4CE3F8F739309F5B81716822
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 5b4348fe4f11efb39680d15b1d0ab7418347a6dcdc50cded5adedaa4e77617b7
- MD5 c32f8d213d2a3070a07c6daaab4a701a
- SHA1 30f0861d10550626089883b0915405783fd325af
- SHA512 e6e934c5998ef328028d34fae2585114298d9ee6a385c08ea8ccdcd41facee9313c5d534fd8a7dd70dbabe9023c2c70eca7b3bbcf1e0f7929b0a9eea823e6642
- SSDEEP 192:MONK64BAQmiUy71WW5GBPK7H+FdGBma2EaDI+U6:MONK6eA8QWIdmmaOTU6
- TLSH T17002F935AC786C7B9EB2BE46F48637175FE8102BE6845B44EAE81B1C00D734C234282B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 7c3207e31ca216cc1efb752a918acf802fc6ad9a9279d646e8ecd1236a19958b
- MD5 0b8c99d0eae2d154c45b38dbe2b91a4c
- SHA1 235682d836cd87f79f831d1b3b85020889db6bbc
- SHA512 238bb0e901883745f29c077e9709a51a4d3972031983529f56db3e6771b4feabe675cee59f7cfbf23bf9be1966397a95db7bca0157443a4882f2e3a3ab14e748
- SSDEEP 192:tONI64BqQmiUy+WQ5GBPK7H+FdGBma2dEFC1SJrrWw7q7b+U6:tONI6emsQIdmmaHCEJr3Q+U6
- TLSH T113120A359C74AC6B9DA2B152F48736135FE8413BEA896F84F6EC7B1C01EF65C2306816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 ffc09c22bef2a8053472e88c2cfb3b39a7745af86e83f520e24933cb14641db5
- MD5 711d7acd4e6a0288c164dee795387b63
- SHA1 2bf4d8c54db29d8b52ea5753ac259176b2de76c8
- SHA512 4083bb170bacacac2549ea967ec2bce83ed185023b7786ed031def019e9c96b222e34af2843aa8ee3df0e85c94fc50b8661471504703b44debb4196d777d69c8
- TLSH T153411748A6F91148B3B36F5AABF6A86D487BBC372E1A945D10110E0F0623A40CD71777
- MD5 SHA1 SHA512 TLSH