12ac3aa185f9fa03ba192820a5d401ca044c4dbad7c2d6ed55f167b963a39927

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260823-apf2dagh58
SHA256 12ac3aa185f9fa03ba192820a5d401ca044c4dbad7c2d6ed55f167b963a39927
MD5 42926c563892a520d8bc0e5bfb071dc3
SHA1 caf348d58c95d82a3edf059c5ba4660e7f110297
SHA512 d0298883782ec8dbc1633b3e6148c511377ac980edecc3b5bf22923a91dd203782c03d1a3317ed6541ab4bfe13130320c04c9bccf24e35270f3ed6aa77078a93
TLSH
T1575189A46D920311F39142DEAA2BDFF0D15FAD0A3BC40069511D9C9178E853FC163FB2
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
456	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319181908052065"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{AD4328F9-4A3A-4CBF-813C-01EA4297A4B3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 648	2184	msedge.exe	82
PID 2184 wrote to memory of 456	2184	msedge.exe	83
PID 2184 wrote to memory of 592	2184	msedge.exe	84
PID 2184 wrote to memory of 4916	2184	msedge.exe	85
PID 2184 wrote to memory of 592	2184	msedge.exe	84
PID 2184 wrote to memory of 592	2184	msedge.exe	84
PID 2184 wrote to memory of 4916	2184	msedge.exe	85
PID 2184 wrote to memory of 2632	2184	msedge.exe	86
PID 2184 wrote to memory of 2632	2184	msedge.exe	86
PID 2184 wrote to memory of 2632	2184	msedge.exe	86
PID 2184 wrote to memory of 3856	2184	msedge.exe	87
PID 2184 wrote to memory of 3856	2184	msedge.exe	87
PID 2184 wrote to memory of 3856	2184	msedge.exe	87
PID 2184 wrote to memory of 4948	2184	msedge.exe	89
PID 2184 wrote to memory of 4152	2184	msedge.exe	90
PID 2184 wrote to memory of 4948	2184	msedge.exe	89
PID 2184 wrote to memory of 4948	2184	msedge.exe	89
PID 2184 wrote to memory of 4152	2184	msedge.exe	90
PID 2184 wrote to memory of 4152	2184	msedge.exe	90
PID 2184 wrote to memory of 1164	2184	msedge.exe	91
PID 2184 wrote to memory of 1164	2184	msedge.exe	91
PID 2184 wrote to memory of 1164	2184	msedge.exe	91
PID 2184 wrote to memory of 4256	2184	msedge.exe	96
PID 2184 wrote to memory of 4256	2184	msedge.exe	96
PID 2184 wrote to memory of 4256	2184	msedge.exe	96
PID 2184 wrote to memory of 4708	2184	msedge.exe	97
PID 2184 wrote to memory of 4708	2184	msedge.exe	97
PID 2184 wrote to memory of 4708	2184	msedge.exe	97
PID 2184 wrote to memory of 2404	2184	msedge.exe	98
PID 2184 wrote to memory of 2404	2184	msedge.exe	98
PID 2184 wrote to memory of 3060	2184	msedge.exe	99
PID 2184 wrote to memory of 3060	2184	msedge.exe	99
PID 2184 wrote to memory of 3428	2184	msedge.exe	102
PID 2184 wrote to memory of 1672	2184	msedge.exe	107
PID 2184 wrote to memory of 1672	2184	msedge.exe	107
PID 2184 wrote to memory of 1672	2184	msedge.exe	107
PID 2184 wrote to memory of 548	2184	msedge.exe	114
PID 2184 wrote to memory of 4940	2184	msedge.exe	115
PID 2184 wrote to memory of 5076	2184	msedge.exe	116
PID 2184 wrote to memory of 1380	2184	msedge.exe	120
PID 2184 wrote to memory of 1380	2184	msedge.exe	120
PID 2184 wrote to memory of 1380	2184	msedge.exe	120
PID 2184 wrote to memory of 3412	2184	msedge.exe	126
PID 2184 wrote to memory of 3412	2184	msedge.exe	126
PID 2184 wrote to memory of 2028	2184	msedge.exe	130
PID 2184 wrote to memory of 2028	2184	msedge.exe	130
PID 2184 wrote to memory of 2028	2184	msedge.exe	130
PID 2184 wrote to memory of 4108	2184	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbe706c188,0x7ffbe706c194,0x7ffbe706c1a0
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,862249351718656203,13220547188225169334,524288 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:3
  2⤵
  - System Time Discovery
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,8012140047987204393,9982124833884706490,262144 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:2
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,6969267631203246487,6826195394954783397,524288 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,6420720770098574124,1255776069887050431,2097152 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,1838194632913732672,12828074910021753554,2097152 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,4447997892601037599,1045769714987068205,2097152 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,5809137661488219349,6527190691663951846,2097152 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3616,i,3463679702476457931,15553394068392402009,2097152 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4168,i,10863060909225999667,4393371347623605182,2097152 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3476,i,5198617970547647861,7069867596747443926,2097152 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,1006671551944217629,18164549365510294395,524288 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,12090837217509088302,5612712769185417774,524288 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,11021659544828573133,7881329235948212256,524288 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,11021659544828573133,7881329235948212256,524288 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6324,i,3818328079387740478,18285742079599177656,2097152 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,5707154460243246408,10556868098932181442,524288 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,9080884169904201834,1726847036114929948,524288 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,8635638099928201318,8296649390692414999,524288 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3484,i,1988248447848939594,13368370557409873364,2097152 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,7875273449197835036,4353603539828635418,524288 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6348,i,11653574422682178294,18060256294744500181,2097152 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4208,i,9162747979170921064,371554914988834098,262144 --field-trial-handle=2932,i,12892478013485945112,80585869633273712,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 6b640e65f51962a67bc19688ba888dc91c06cb8d6b3f9faddf9883b5d5ea56f8
MD5 7b68cca113912c8d5df33624d440b495
SHA1 54f3417051ccb61c679045f6446f36ec8c23cf2d
SHA512 649d749dd33869414f9689d0975faa1c06d669df98caa6d1538cee29c837d87be1d9558c6098c8f3029da490c266fc71f851b7551fcf7b574233e9a83a6a16dd
TLSH
T1B0612C3800554C93E7C52133E4FFC94074B985EAFBA3EE2691376CBD6A0E729814DAD8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d721.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d721.TMP
Size 3KB
SHA256 c9d1d7334bfc1b70e4f25acd5530e805ccc4875fc8436f59fc1b3e8ceae6b930
MD5 c18909db837cab4a56faad02900ec8f8
SHA1 0b27b2dc59ef9b216eb3051f8b32093e8e5f3f72
SHA512 ed8ec766f08ab037608ee52afd9dfbb67a55c8acd7c92dc82acb3dc4a75e9caf1b006e6485be0269a3f1069a53331b2ed3fefb22ef27d1031f1f56fa5e7c5b80
TLSH
T1D1612D3800464C53E7C52133D4FFC94474B985DAFBA3DE2691376CBD6A0E725814DAD8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8b6174e0d08e76b358ab75b8aa60c248bc38b0e833355118c04ff715d18284ae
MD5 81afe6413f2f90ced6d4fd4dc88a4452
SHA1 5336a5df70c80c239947574948868d881497f701
SHA512 cb62f171e905be741510528b138f723028d67f9d607398e56fa6552be468248b62570a5632e543c30f5207274b75707fa31071809a3b894849ed57f7d652bed6
TLSH
T1011157B783E5856ECA1156F09A18AE2BCE1D0506432C3C1A8AE4EF27D3E3076E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f5524c2c3039c7e8247ca8cd27d7e02fd31371872ffd66a7132b2cee35f79921
MD5 925a07d03c425a310c66a79246c584aa
SHA1 a11eeadc33a4059e44732d07b30eccfb6aff6642
SHA512 dffbd54e9a6dc5b84557f6a66017bbda1b4972a5c0cbf5e7e174b706308072ca8b8626f86abaf26283d49ba0e11ec84cb2a9a8f3d3e8f07db5b000af1d6d3fc6
SSDEEP 192:sxZfRHkV/fNsavXDx7IdpdaKHW6+WNGY9IK2TWIgrJ:sxZfuV/fNsiXDunHbGE9
TLSH
T1E022B8126E38A4778CC7E219BA65BF13E6F5503191941E58EAFCD61C05E7ADD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5d20917ca3f7d717086fb83a66b29bc6cd11f3d68b90935818f272dc07c80fc8
MD5 e617ca1146a172a82e07c71cd6886875
SHA1 15c8158895beb01b10e618d3dd497a89d65092b3
SHA512 5ed60adcecda195ee712ea37b394d9f7ce80d96aa3b0668caacefa6f8795fb7d2955abc7b73e4f43773ccd8ae878302531315ec47b48c44026011594385f8560
SSDEEP 192:sxZfRHkV/fNs1vXDx7IdpdaKHW6+WNGY9IK2TWIg58J:sxZfuV/fNsJXDunHbGEG
TLSH
T15C22C8126E38A4778CC7E219BB55BF13E6F6503191901E58EAFC961C05E76DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 68a4434bb85824ff14de9bc3b7b99413c58903f70678ea2effd9d817aacb927f
MD5 f8db6a59285c8c9695f430d6ef2c9069
SHA1 c34091bc89688f342bc15171e194bbb709737f66
SHA512 204c8423137175058036a01cae1322f7309e41f11d87097daa72a64ad336a8a4e4897480dfb6225b5e8660fcb58d01729ceac2dad2387b2415556e65d9bc63e1
SSDEEP 192:sxZfRHkV/fNs1vHDx7IdpdaKHW6+WNGY9Ir2TWIg5uJ:sxZfuV/fNsJHDunHbGNE
TLSH
T18D22C8526E2868778CC7E21DBA55BF13E6F6503291910E58EAFCC61C05E7ADD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f316a7b847ba64f0733da152091a2501c88b8c45033126cf394198fc20cf2859
MD5 3dae58816d9dcf99e7ae40306fb6334e
SHA1 3424a9523c095ec9cbbc667241a7d58107848319
SHA512 6a9e3a06ff50d5acd3fd7abb8225af7e96a4070cdeb16e65860311fa425dad31cc632fb4a010c3fe619357d349731357980b36968e574eea6999787285269e04
SSDEEP 768:xbyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7uroZcbqW:xbyvIZwWvu+Q+u1jamFLeR7lqr
TLSH
T12FC2EA2B240CCB7E5F801E9DDD5A6F9B3EA802CB67588D4047FD994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75eff134-1d26-48fe-b997-17e0957cebd9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\75eff134-1d26-48fe-b997-17e0957cebd9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 acf05ab12a431eeed64d82a9f8788ff9b52494670acbd22d71b1f1a3c765fbd7
MD5 7a0833570e05e3d9b82569008a874ca2
SHA1 2d8e455635983422badcd0c603edd0403143c00d
SHA512 2c6805906d590a41f4ef0c2443d0f5ee2af738843e8e7be612b877fa317400b172f40cfb738fc46fe890e5ce2be2c2ab05d8cf1ef4a3e4b7e88c2b8bea148642
SSDEEP 384:IiFiZcI1sND8TUNTUlIlk6ziZMpe+CeODejhYJfivwunou:TFQ16wgHrw2OijhYlioun5
TLSH
T16FA26D735C688C7B6EBA9785F94A31138FB88073D586BE94E5DCAE1C01DB5D8130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 21a5a3dcb2ff7c407f783f3b825d7b1fec8ba8c7c3ea6bdfb416c0cdb0b0cd58
MD5 368c9d82a50a8ffbc39adc8cfd6294d8
SHA1 27646283bf4bed3fd10fce781b54d942861b3438
SHA512 f8f082d0ff3d1aa7a6eda627b33750718928a31a0835b5da39bba55d1aadc42351183eae6e0a4c3438c1dc2f03bda0abf253edeaae484c23cbda1a2e8cc87551
SSDEEP 384:GZcIhsNxp6ziZMpe+CeODejhHJfivwunou:Uhlrw2OijhHlioun5
TLSH
T152826C725C385C7619A69285F94735178FB88073D6CA7F8494ECBF1D01DE6E8131BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2207e8bee30274f04a2da76d2f083989764bd395e4c7b03b7c0956e303cbaf4f
MD5 2f517f96e41f799f5be3e3ddedc72720
SHA1 d2b618ac585be5f56177cbbaf289c391cea783ef
SHA512 89a2db62b36cd3e39b0a8fd3ac51c90ecf5974f0a17b10a09c42596b5ffaa2df7e679bbc2d763767d7595c6b5a03eef590c0de4de94cf48f30509b39a6416c17
SSDEEP 384:9ZcIhsNxk6ziZMpe+CeODejhHJfivwunou:lh6rw2OijhHlioun5
TLSH
T1E7826C716C385C7619E6A285F94735178FB88073D6CA6F8494ECBF1D01DE6E8231B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cecc7d5ceca5e8f70290b6fd2d552d362cceb03b69bd13fb6e39dd4e4efc644f
MD5 feca683c046d81054107f8abd8e34972
SHA1 56c4096d7a1afa7d9610454f5467f499431936f6
SHA512 4f4bd9155bf2d39d3710e88d3c565dcf52f58873b919b2e291d151add36de1f2acd66515a75b2a3cda28cbd42868cd0bcf90e1a20d3f9ac0022c0bde53a7ae53
SSDEEP 192:JONj6v+YLNQmiUy+f/Zh+CGLOD9oqusJeZU6:JONj6vz/vZh+CeODeMJqU6
TLSH
T16D02E935BD382C7B9FF2AE45F98736179FA81177E5952F80D9E82B0C01D769C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e1e229384f34bd60de42e83c39214369f389580ecece23d84c14a051fbd8ae0a
MD5 105f41bd7f57eab52a16a2dd8393933f
SHA1 2002312b0c10f5cd734264c4edc38831717e2798
SHA512 35c7130628b94d7cd6425e101adfc094d928e250dc2c435a49498d5e2ca3c83e5c73c448b4e32912b974b64a0d8092cd90f7df50194cedb6666b15cc2de3b52f
SSDEEP 192:yONU6v+YL4QmiUyhf/Lh+CGLOD9ojhJCHJVqOU6:yONU6vzcOLh+CeODejhOJfU6
TLSH
T1DF120936B8385C675EE2A985F48735139EA99137EA867FC0D5DC3E0C01DF6DC234A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

049765b0-c809-4c0a-bac4-d1b76d515497.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\049765b0-c809-4c0a-bac4-d1b76d515497.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b5199af96c03b8d87c77f86983bdf7c619639dc5e121cb0151eee1a2f11775b0
MD5 7288509b24554cead32dde60ac96fa01
SHA1 9f01b5a18202b858775b5247f91237181e9e5c99
SHA512 273498cb9ae106aff28e73a03b6a33a5a5a6ed1e4e6428b54bf2110c22bc07087e1eeb13dd7730e93ea3a46dd1e456797fb0d6c272354c936c0a40858ece8147
TLSH
T13441F358BAEA1148B3B37F56ABF6A86D487FB8772F0AD45D00110E4E4A62B41C871737
MD5 SHA1 SHA512 TLSH

Submit Download