9a64d7f73484ae81f019c844f3754c7806f520be60f5faf7ff930a7292154855

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260817-pl42csbk3v
SHA256 9a64d7f73484ae81f019c844f3754c7806f520be60f5faf7ff930a7292154855
MD5 f3b48b3bcca0160d0a96544e43acaa52
SHA1 6118c10692046d20c902f261fd332b52d7652037
SHA512 7ac7f722f30353698e4293332fa68f29f1213e18c65555a03241f509d018a7ef4dbc5101516c0b067760887dfd304486a63268d6bce27261dbc05a5f47123063
TLSH
T15A5155703D6031E2BA994BF37BAA3DB4D06BB8074880441BFED091B4F92457AD9226F0
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4636	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314431671601656"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{91FB5D1A-6598-4942-92A9-C3E0CFE8C518}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 4428	636	msedge.exe	89
PID 636 wrote to memory of 4636	636	msedge.exe	90
PID 636 wrote to memory of 3460	636	msedge.exe	92
PID 636 wrote to memory of 3460	636	msedge.exe	92
PID 636 wrote to memory of 4568	636	msedge.exe	91
PID 636 wrote to memory of 4568	636	msedge.exe	91
PID 636 wrote to memory of 4568	636	msedge.exe	91
PID 636 wrote to memory of 3660	636	msedge.exe	94
PID 636 wrote to memory of 3660	636	msedge.exe	94
PID 636 wrote to memory of 3660	636	msedge.exe	94
PID 636 wrote to memory of 3476	636	msedge.exe	95
PID 636 wrote to memory of 3476	636	msedge.exe	95
PID 636 wrote to memory of 3476	636	msedge.exe	95
PID 636 wrote to memory of 404	636	msedge.exe	96
PID 636 wrote to memory of 404	636	msedge.exe	96
PID 636 wrote to memory of 120	636	msedge.exe	97
PID 636 wrote to memory of 404	636	msedge.exe	96
PID 636 wrote to memory of 120	636	msedge.exe	97
PID 636 wrote to memory of 120	636	msedge.exe	97
PID 636 wrote to memory of 5324	636	msedge.exe	98
PID 636 wrote to memory of 5324	636	msedge.exe	98
PID 636 wrote to memory of 5324	636	msedge.exe	98
PID 636 wrote to memory of 4436	636	msedge.exe	100
PID 636 wrote to memory of 4436	636	msedge.exe	100
PID 636 wrote to memory of 4436	636	msedge.exe	100
PID 636 wrote to memory of 4816	636	msedge.exe	101
PID 636 wrote to memory of 4816	636	msedge.exe	101
PID 636 wrote to memory of 4816	636	msedge.exe	101
PID 636 wrote to memory of 3484	636	msedge.exe	102
PID 636 wrote to memory of 5912	636	msedge.exe	103
PID 636 wrote to memory of 3484	636	msedge.exe	102
PID 636 wrote to memory of 5912	636	msedge.exe	103
PID 636 wrote to memory of 2304	636	msedge.exe	105
PID 636 wrote to memory of 2844	636	msedge.exe	108
PID 636 wrote to memory of 2844	636	msedge.exe	108
PID 636 wrote to memory of 2844	636	msedge.exe	108
PID 636 wrote to memory of 1564	636	msedge.exe	110
PID 636 wrote to memory of 2988	636	msedge.exe	111
PID 636 wrote to memory of 1832	636	msedge.exe	112
PID 636 wrote to memory of 5032	636	msedge.exe	113
PID 636 wrote to memory of 5032	636	msedge.exe	113
PID 636 wrote to memory of 5032	636	msedge.exe	113
PID 636 wrote to memory of 5208	636	msedge.exe	114
PID 636 wrote to memory of 5208	636	msedge.exe	114
PID 636 wrote to memory of 2872	636	msedge.exe	116
PID 636 wrote to memory of 2872	636	msedge.exe	116
PID 636 wrote to memory of 2872	636	msedge.exe	116
PID 636 wrote to memory of 1704	636	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffc1c5bc188,0x7ffc1c5bc194,0x7ffc1c5bc1a0
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,111386440371886213,9724989697651059403,524288 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,17755145535848179186,5352116364293711548,262144 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,5862421224935002969,4837512983221821749,524288 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:13
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,13770556368115735793,10288678006729153661,2097152 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,9538525510861096063,7667693471992376379,2097152 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,17982454599722175761,9396292390719566729,2097152 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,6802053959998255818,9130029907938567339,2097152 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:9
  2⤵
  PID:120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3752,i,12886284362637369594,8664880448486809887,2097152 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5436,i,3979889925429037482,16972745295192811115,2097152 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4636,i,226537414866740300,15982030646339081781,2097152 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,9770894124731485815,12656115872219211731,524288 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,11174690325744657747,18074936381006911111,524288 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,8004211163580881321,6811038602963828869,524288 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,8004211163580881321,6811038602963828869,524288 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3840,i,6333913836181442788,11410921492686141931,2097152 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,2520896972330240162,16388841382325731001,524288 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,13903089257085243256,2798557314812955589,524288 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,15297776095818970792,17302568659470628891,524288 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=2740,i,28198863066008127,11895067565571813612,2097152 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,17981052548566524906,16959738034686114498,524288 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6960,i,17751073979200247595,13497205162424259161,2097152 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7024,i,11498118136747869824,3958049479291413165,262144 --field-trial-handle=2244,i,733911008050632070,12451015819815676352,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 196dc63619fa6c32ce34bb1f231469245601c969b7fe4472feb80fd18bfec859
MD5 b69f7c4631d5e5a3cfa46d93258ec830
SHA1 25f74106f845628bed2313fb54b4079b80c69c22
SHA512 efa3b653027710818b449951bc0df30125a6ef127c716aab0527c21d05af7c129fddacd041c73fa0565fccc80526c8aadfd37d700796da5c8771e340df034cb3
TLSH
T14031DCE7536F49C2EF7CA2B352D5649B3330A4A9C7077F90908DD27695423485237065
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596eae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596eae.TMP
Size 1KB
SHA256 dfbc22e6aa4607b8bf0ec0b23531a2c834211c3f08afab46192fabe57cc6b8b8
MD5 49d9fc8c5eb0b55a6ca208e315470830
SHA1 31463a2b8b3a033bd4e00c73970297cc8ba551f9
SHA512 4282f8e3790dbaed54441f6ced01f92eaf3b21b013f2e388df8f539b6a2154cc0f4fdb579e37ddb60cf0721c828c6df5559a96d482715daca375503a7d21c049
TLSH
T1E931FEE7536F19C2EF7CA1B352D4649B3330A4A9C70B7F50908DD27695423485277065
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b37d4d208587fa40c11b924f2609793e5a622f747458a11bacadd0a16877b05b
MD5 1ec77878ec76ecda41ad308991bdffff
SHA1 3a9e3b3a2b5a5dba373761adc5e0d94c0f77c51c
SHA512 44feeb5afa9ea007b3bb2a53893f70170a9f8a89d6ac2f340a0a7fb1b0f5a08e63d68e1f8dbb8f9288bf1452c058c0d3c1c78ac5da34bad690bac889b08823a0
TLSH
T15B31E0F783F4857E8A1196F0AA08AE1FCE1D0511432C7C6AC9E4AE2793F3472E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 89b1a794f47c93f628a60fcd8af75a06790b23b121d7da4867a2c1e5d5c4015b
MD5 7e408a0cdf31d0c390ce0c203f8090f0
SHA1 51ae8a3cc09ba456d832e8e61ac1df06d8fb97e4
SHA512 302746d55494fe6ff4f1a83041d7fc09589bd341c643b00e4649260277f429313cf0d6ac363e5ce58dff51aac306de518ac1e8a21992469b418fb119d4e2bc60
SSDEEP 192:sxRfcpRwcbAu/fhksndHFSaZg5zoA8p4fqf+/g6+WNIYbCfvZ6bKGszlIgIJ:sxRq5r/fCsndlSa3o/5I96Ks
TLSH
T18F32B7156A28A93B4CC7E21DFB567F53D7F91032A1951E48FAFC861C04EB6DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b1d779842a5d5431a0ba94d8f5733b05d9b25b207a0d2a31bf45501783e7fd17
MD5 1534f1443c5c6c50a88d8831d949c988
SHA1 b3c90b9419770cda8918a26cc0fadc351d4d439b
SHA512 42b9037a3181423fd5943e7839740ecd56c1825b37c06f94b8c1349e532e4a085cb9a837475fd66e885dd660fa3c8c5e3d6dcba6c9dc52a5d7f72aaf420dd4ca
SSDEEP 192:sxRfXpRwcbAu/fhksAGhZHFSaZg5zoA8p4fqf+/g6+WNIYbif3Z6bKGszlIgDV1J:sxRh5r/fCsJHlSa3o/5IJ6Kh
TLSH
T1B342B6166A28A93B8CCAE21DBB567F53D7F9103261951E48BBFC861C04FB6DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3ac5b2502e65824836c7bdc22c85e38b30c7d229b7b02ee92fc301d9420be4bb
MD5 c18127b9cf4be699a80eac75ff3436b4
SHA1 f0accf69089cfa30d9721f95569a303061b0a552
SHA512 74be2fa45a7dfec180b6e15cc0925df9c4fc74a11273239c5359dfe580b63d6357b2ddd007c69d58eef7c99936e448da7beb16414a5028f0d338bfe0714dc528
SSDEEP 192:sxRfXpRwcbAu/fhksAGdHFSaZg5zoA8p4fqf+/g6+WNIYbCfvZ6bKGszlIgDVzJ:sxRh5r/fCsJdlSa3o/5I96Kj
TLSH
T13032B6166A28A93B4CCBE21DFB567F53D7F91032A1951E48FAFC861C04EB6DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 5fd61ab69b18fa32c80f8a45e9dcfe3513773fc4be270e58d033151e4c07288d
MD5 9eae81bc7a588e62df07ee140da685a2
SHA1 970d03f607be3a53d6c8bb929bc47055c132c532
SHA512 a410c67288de2f30173034de552909f17740c76965cc2714dab607dce34d6ff1523ad776b9e087c8d623e39f26a39bed85d37ce034e9a76c3fb59207f64ae574
SSDEEP 384:Flp1pABfCtgisFfq4KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVnz98ERFproAol:Fb1pAtWgikfq48F1+UoAYDCx9Tuqh0VF
TLSH
T15AB2DB3B600DCB7E5F800A9DEC19AFD76D9802C796988D4447FE994C02C77FA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 384e9cce7edbab579907ab953a21fe6ef0d56c3bfdaad34aee6fdf4686976479
MD5 bf9b9d7f7960313dc9383f51df8a18dc
SHA1 1ee8c96c21a7b8f59bfce101668517effc00912f
SHA512 4df73bdb77ab8a161a8f4ffad359fe4e9fe27fe0f512591ceddb7312b527f6cc1e9a0c183ea6d8a1309124b1d5ea19799e477a03679b6a220697d49653f98e5e
SSDEEP 768:Vrv+4UNbd+3v40BqobGzERtZu4aWADIidy8Luy8pJ/rhn+I:Vbsbc3JtZzaNsuVLFoJ/rhnd
TLSH
T14813CF36F819AE739CB6A284B1473903BEF8925385C90AD088DD1F4E44DF4AE131BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 45d6857c534696172da058845711f1c502b2b65b23e1c8415b9d40c8d94499ff
MD5 084999fe0c88f3d6b3ed20694c3f45cd
SHA1 5fa27a118442d8612b2928b8dd623d76eb40609b
SHA512 02461b71ee7df1f346c5228f8463a114e424f2c7c148749b61ffc38bb5fa5ef67a02ae9666e10d97b95dabd5808127f5487c142d26118cde3ac67b6e5bd76608
SSDEEP 768:BB3sm0BqobGzEItZu4aWADIidy8Luy8pJ/rhnx:BB3NtZzaNsuVLFoJ/rhnx
TLSH
T130F2B076FC569E779CBAA284B2423903AEF8D263D5CC19D548DC5F0E04DB4AE0357C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 7b7849cdd4524d0a5da772e6bcae480c2d9e759bd121ceeff9e712cbf719419d
MD5 d094823f36878b5c6be423aa0cd138e1
SHA1 87955cd17478ab09711da59bd49e4eb6043693a9
SHA512 c2d2a7dc416f46e80bc5c133d615a17fc70af07acef623da4093563a056f2074bf5eca2b07353077146ccceead95adfa0dc82ee032d89a46c050f77b435f21da
SSDEEP 768:LB3/m0BqobGzEItZu4aWADIidy8Luy8pJ/rhnx:LB3ytZzaNsuVLFoJ/rhnx
TLSH
T1FDF2B076FC569E779CBAA284B2423A03AEF8D263D5C819D548DC5F0E04DB4AE0357C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 ecb9748460b0f0a4638296dad8082c4285be255060f12aaeac3895f0d2c9dd0a
MD5 66d4e907c979cd49fdc032de22d835da
SHA1 82529fdb437f65d1bde89856c1a04e089bf3545e
SHA512 0fe236b67c4f786d79a7d34b1e0ecf988406c4364edfe905822fadbec78483a3922a5a66f3d96eecd67fd9e86896e270fcca1c8cbbbc12d7af58e01d83ee457f
SSDEEP 768:kb3sm0BqobGzEqtZu4aWADIidy8Luy8pJ/rhnx:kb37tZzaNsuVLFoJ/rhnx
TLSH
T1A7F2BF75FC569E779CBAA284B2423A03AEF8D263D5CC19D548DC5F0E04DB4AE0317C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 cd06b05ff48be3baf77aaf6b6afcc5b7a947b251a41cfb9611ca8bf18dec9dc7
MD5 2f87562840c0b96793f867d7ca987822
SHA1 aa6dec4a95cae2abf864a15cec6dbcaffcef40fd
SHA512 51ed5781a637c827388718353ec828c3f3b725004441aab790890d377e34522e491c9b1dc42a09523d91bdf1efc46eecb37e131b258e35a593305278fabfd738
SSDEEP 768:srv+4UNbdC38YOBqobGzEPtZu4aWADIidy8LbyeVH1S1C:sbsbw3gtZzaNsuVL+EH1d
TLSH
T10903BE36F859DA735CF6A284B18779077EF8925386890AD088DC1F8E45DF4AE130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 42dc23a52f74822b9e8dfad8a9d2876832cde7501e957b069cb5631d18015226
MD5 dadba1d073241e0dd1a05f85bf363727
SHA1 32507e1edf1fd4378bd4b8ce287f4f94cd19c27b
SHA512 db3238142f1795d1a253f5c11565c89d097f1fd2e777fc0b071842605a92e56d541f0dc30235119bababee97a09ec5e5c8882916a1e3739ed458c5b77a8c5db6
SSDEEP 768:9rv+4UNbdC3ygtBqobGz9pZu4aWADIidy8Lq9eVH1S1C:9bsbw3epZzaNsuVL2EH1d
TLSH
T12103BF36FC59DA739CF79284B1877A077EF8926386880AD088DD1B4E46DB4AD1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7061bdd-8f5f-465c-96bd-272e6f272365.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d7061bdd-8f5f-465c-96bd-272e6f272365.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download