12ac3aa185f9fa03ba192820a5d401ca044c4dbad7c2d6ed55f167b963a39927

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260823-apf2dagh58
SHA256 12ac3aa185f9fa03ba192820a5d401ca044c4dbad7c2d6ed55f167b963a39927
MD5 42926c563892a520d8bc0e5bfb071dc3
SHA1 caf348d58c95d82a3edf059c5ba4660e7f110297
SHA512 d0298883782ec8dbc1633b3e6148c511377ac980edecc3b5bf22923a91dd203782c03d1a3317ed6541ab4bfe13130320c04c9bccf24e35270f3ed6aa77078a93
TLSH
T1575189A46D920311F39142DEAA2BDFF0D15FAD0A3BC40069511D9C9178E853FC163FB2
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5212	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319181888937148"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{7FCBEF9F-4ACA-4CC6-A9E9-FF10D311E8FD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4580	3328	msedge.exe	88
PID 3328 wrote to memory of 3644	3328	msedge.exe	90
PID 3328 wrote to memory of 5212	3328	msedge.exe	91
PID 3328 wrote to memory of 3644	3328	msedge.exe	90
PID 3328 wrote to memory of 3644	3328	msedge.exe	90
PID 3328 wrote to memory of 5820	3328	msedge.exe	92
PID 3328 wrote to memory of 5820	3328	msedge.exe	92
PID 3328 wrote to memory of 4192	3328	msedge.exe	94
PID 3328 wrote to memory of 1492	3328	msedge.exe	95
PID 3328 wrote to memory of 4192	3328	msedge.exe	94
PID 3328 wrote to memory of 4192	3328	msedge.exe	94
PID 3328 wrote to memory of 1492	3328	msedge.exe	95
PID 3328 wrote to memory of 1492	3328	msedge.exe	95
PID 3328 wrote to memory of 1428	3328	msedge.exe	96
PID 3328 wrote to memory of 1428	3328	msedge.exe	96
PID 3328 wrote to memory of 1428	3328	msedge.exe	96
PID 3328 wrote to memory of 2732	3328	msedge.exe	97
PID 3328 wrote to memory of 2732	3328	msedge.exe	97
PID 3328 wrote to memory of 2732	3328	msedge.exe	97
PID 3328 wrote to memory of 700	3328	msedge.exe	98
PID 3328 wrote to memory of 700	3328	msedge.exe	98
PID 3328 wrote to memory of 700	3328	msedge.exe	98
PID 3328 wrote to memory of 5048	3328	msedge.exe	100
PID 3328 wrote to memory of 5048	3328	msedge.exe	100
PID 3328 wrote to memory of 5048	3328	msedge.exe	100
PID 3328 wrote to memory of 2072	3328	msedge.exe	101
PID 3328 wrote to memory of 2072	3328	msedge.exe	101
PID 3328 wrote to memory of 2072	3328	msedge.exe	101
PID 3328 wrote to memory of 5920	3328	msedge.exe	103
PID 3328 wrote to memory of 560	3328	msedge.exe	102
PID 3328 wrote to memory of 5920	3328	msedge.exe	103
PID 3328 wrote to memory of 560	3328	msedge.exe	102
PID 3328 wrote to memory of 2132	3328	msedge.exe	105
PID 3328 wrote to memory of 796	3328	msedge.exe	108
PID 3328 wrote to memory of 796	3328	msedge.exe	108
PID 3328 wrote to memory of 796	3328	msedge.exe	108
PID 3328 wrote to memory of 2636	3328	msedge.exe	110
PID 3328 wrote to memory of 2804	3328	msedge.exe	111
PID 3328 wrote to memory of 5180	3328	msedge.exe	112
PID 3328 wrote to memory of 4688	3328	msedge.exe	113
PID 3328 wrote to memory of 4688	3328	msedge.exe	113
PID 3328 wrote to memory of 4688	3328	msedge.exe	113
PID 3328 wrote to memory of 4608	3328	msedge.exe	114
PID 3328 wrote to memory of 4608	3328	msedge.exe	114
PID 3328 wrote to memory of 5128	3328	msedge.exe	116
PID 3328 wrote to memory of 5128	3328	msedge.exe	116
PID 3328 wrote to memory of 5128	3328	msedge.exe	116
PID 3328 wrote to memory of 2208	3328	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x260,0x7ff8a152c188,0x7ff8a152c194,0x7ff8a152c1a0
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,8557160444859523719,668943388128485072,262144 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,34902247083389392,11904231553321592242,524288 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,17505886307839180708,9197661253361026505,524288 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:13
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,9889233434266551706,2762217180828378485,2097152 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,14665292487842107670,1352379945912671378,2097152 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,13296706581901667107,6169047207512644266,2097152 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:9
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,12726306555416937474,9432623083877431113,2097152 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3796,i,15376980490227775494,1529772707168878511,2097152 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5372,i,6049981793998265642,5469197011431487782,2097152 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4788,i,9160330618548242866,11487397697907260529,2097152 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,14823001456296616608,14408537301685097261,524288 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,12156309527913120541,7000629266926319037,524288 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,13892890999317644903,13974445426392582953,524288 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,13892890999317644903,13974445426392582953,524288 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6636,i,868571218071442351,10496563003763599315,2097152 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,1374499066901648921,889082066281884096,524288 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,10618718380558266559,6530206117626797862,524288 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,15300167713254655406,244816397714130484,524288 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=2132,i,14049393106809402532,6087258079385807439,2097152 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,7111538459395934642,7649204247927030390,524288 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6156,i,4452305121862885456,1030533654548459158,2097152 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5220,i,7510334591593963528,1842287191059663920,262144 --field-trial-handle=2384,i,5259774740917556211,9663853909735483104,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 23879fe94d6eb1dc5f592a914649aaa09bb315a6340f40aa14a5d3fbdce5e5ff
MD5 509c1ec4bbe8c97e7d7561d6c1f6d6c4
SHA1 4b7c6e5830578f18f4ac1f30ee0988c7731c8d96
SHA512 bbe40dbaea4c9a8c049868e3882146040920730f1469eda2ff4123ebbf5ddc4ce487f388994aceb056bcea0f00637b6b4f566d2ab288e472b3644d71f439e853
TLSH
T148614D94872DCFD2EB6444B160D487E93A39B6A109C7FA10F2F9EE73689AE080105F18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593bb7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593bb7.TMP
Size 3KB
SHA256 479b9ad5f80fd9d18d014cd4ca839daff4d393ef50b067ff3b7347089c30fe26
MD5 e1c6e9541f6b6e27ab783ad95f416900
SHA1 63eda1b3df95aa11641ed5cb6c3ca825ed7758d9
SHA512 fe6d15ab41d1320dc48ccfe1210be8c4baee6bddb8b661171bb4ab70bcc7e5518c698834a72537921420a2baefacd3b4a9492cfea479b0f1b0c69b752b0f3d2c
TLSH
T102615094871DCFD2EB6444B160D487E93938B6A109C7FA10F2F9DE7368D6E081145F1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9a31252201f03375da1663c93277de2f0fb0019813dc12b76aecaec93084a165
MD5 ae5965eac1e1e9519a5ae9e3faadcc4b
SHA1 44c7744a456d6a07069d1ff3e1bbf7a905f84599
SHA512 b4d1258c25b60ebeb63c5437c67ed7375f7d319c68b658a7a51559baa9c0d1bd9f5bd09852666072b3ff4258b7c371d5c19a901b050f21deeaf460cd445dec83
TLSH
T195116DF787E5856ECA0156F09A18AE2BCF1D0515421C3C1AC9E4EF27D3E3476E002A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ebf05cadb7c0d12d7a9c2322be63caacc2562bb66276f3eaeefa933d6502a34e
MD5 13585202770302df9164a90e8409a573
SHA1 c370749c99a38165a9ff07b5d16ba6477bfbabea
SHA512 381191324a451da4a60ab104637427d3d59e20d4f574cfc4fe0827b629a269d45d21caecca86ea716caded7b8537c840ec571af343aabc4608185235973401ea
SSDEEP 192:sxR1RXb//f1s1jSMsmZHzoA8p48g/g6+WNIYx0lnJGGmIgD9J:sxR11//f1spSMY0/5Id0L
TLSH
T13B42C8165928A93B8CC6E21DFB567F53E7F95032A0D41E48BBFC9A1C04E76DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 521250e68c41c9a84f43aace4459fe02a7a358a6c0ebbc84d32f06f948549277
MD5 2e43022bee6806f3a63752579837cea2
SHA1 77ce778821dcdf3255aa9d207d0ec3e7d1827e23
SHA512 e0c335adbd1cf11f25d9e1d830a1d3af3e645d8a4f66c022544020cfe799f482d494d80d3963826927ee0f3d47cd8b7482cfda55cb4925ef8b835bc28f427e19
SSDEEP 192:sxRCRXb//f1s9jS1smZHzoA8p48g/g6+WNIYx/lpJGGmIgIJ:sxRC1//f1sBS1Y0/5Iu0s
TLSH
T15B32C9165928A93B8CC7E21DFB567F53E6F95032A0D01E48ABFC961C04EB6DD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c7724cd9c344bbcd42baa34ff17de9124702316c9a68a378b2acbc0bf2c9c524
MD5 04b06551771620e0fa07a30815ddece9
SHA1 a9067a3dffa7496e57256bd7b6cd8bfd2ba51a30
SHA512 78dd56807b5c4838290efbeaa02a845499e731a9335b0c6f9763d7b10e24b0cebe201fd1e0a045acccbf48c6c43cf786e7c4507a421a6abbeef625f0866f2b8f
SSDEEP 192:sxR1RXb//f1s1jS1smZHzoA8p48g/g6+WNIYx/lpJGGmIgDrJ:sxR11//f1spS1Y0/5Iu0h
TLSH
T13632C9165928993B8CC6E21DFB567F53E7F95032A0D41E48ABFC961C04EB6DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 48bc54fe992426265d6565aa69dd0e86cd131d00e8856bd92f8a7e8eadb40870
MD5 93fe9337a86e4c3cc0aa0980a91905f6
SHA1 4c01604c5a9c9a2b280f0889bc95547ab9fd44c8
SHA512 efae96b4c8a61bc8992691d57a17360a3ec296063b30e7a3d8606b4af92603d59b638dbaa291b8035935c95c4cb699ee3e991ec8204444c93365c4aafd667a78
SSDEEP 384:0OxEyGzfCtgbpFfp1KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVht9V3Rkvroru8:0YEyGjWgbrfp18F1+UoAYDCx9Tuqh0Vy
TLSH
T163B2DB3B604CC77E9F800AADAC596FD77D9802C797988D4447FE990C03C77EA911A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

8410e3af-b606-4ade-a678-ca67b01544f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8410e3af-b606-4ade-a678-ca67b01544f8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b3b46ddcd21d166e2c4b42707b948da659f0b1382d9eb6e36eff6938a525d888
MD5 865a12356a5e427e5398bad6d35b53d5
SHA1 2e9e9d9d9bc66dbb03538529daadaa632b25fe9c
SHA512 1400a9fe039065eb3aed03073f039ed5b013a4f1b418fb45907f2cdabe219064e0aa10635bd5a4e04c550ee8dc078752653182139f011bdad4e3cac0d33d73d8
SSDEEP 768:wrv+4UNbdf3e9PkKL2D4lhjF669yrqUjWiIwwxMt+aQ:wbsbB3emkTjF66INWZTMsaQ
TLSH
T1B703BF71AC689AB38DF2D78571037283BFB4515792C50F98CADD670C068F4DE234B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 39d676f5ec3ca1c3014fd5da27493bc1e37a697115199230f835851dfe9d04eb
MD5 4460be94ee084565f7aba4e83cb759ec
SHA1 89b2c523d511dbe528e6bb4d7564ffc120648b2a
SHA512 2d3806eefeb068386b3cb14e8dc8466a6e21819ad5a0be787f340b35bc32c033c651320fce146993fcfcdd0dc2ae45c0d57b2ca71cc30b369011cd1f7969a7ac
SSDEEP 768:WFQX3dwgeSPkKL2D4lnJLF669yrqUjWiIwwxMt+f7lvd:dX3aJkNJLF66INWZTMsfxvd
TLSH
T13DF2AE729C948AB78DF6DBC5B2123342EFB04063C6D95EA896CDAB0D015B5DD134BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5757bd9d9bcefde540edba3acad8e6dc41db2a578d2a632a451bb31ebacd50fc
MD5 c923e2039881fea3dac4c25d31598da6
SHA1 6ff08aa69c68c97544b6c65e93b0c332a0f32cd6
SHA512 a2a7b70fba6c20c05ff771f1e98b019e1ce60d41bead4f52b9ea69c4e11f9d1f5c68eb910f5e6b71aed0c89ceb8107dab9fb3d503762e3b359b27c409d505c04
SSDEEP 768:rc3ISPkKL2D4lhjF669yrqUjWiIwwxMt+f7lvd:rc3IJkTjF66INWZTMsfxvd
TLSH
T132F2AF70ACA49AB789F2D3C572133382BFB08153D2CD0F988ADDA70D059B5DA174783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a68c9ce56cd78365cdfe446b6d7f065e07d4875c93f412e0476ddc4822f2e84a
MD5 2826a743ae0b1007e9c086dd44b6fa95
SHA1 1fc0a08d7a9f4de230cfe962cfca19253024dc52
SHA512 f32213e0c8d856606f855ebc3499eaf5954e48d55b9a3674fab70b0187a4d62cf03f6ff1819f9a321fa99b7dbafba643c06e90bbe01187c9733cb675d0c2616e
SSDEEP 768:xX3ISPkKL2D4lenF669yrqUjWiIwwxMt+f7lvd:xX3IJk8nF66INWZTMsfxvd
TLSH
T119F2AF71ACA49AB789F2E7C572133382AFB08153D2CD0F9886DDA70D059B5DE174783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 46d418ae2d165de25f604fb1124c9f39749a8d9c572d75783b200dc2cfde10b1
MD5 82740c9b3cea8f58f8ed514dd628ee68
SHA1 33adc26ef0e027a332992aeb058084356be29e61
SHA512 494f0b93562b938cfa445503d7b109ae972709c588b58f2df8948195098ce5d4c860ae13516738b10102a767ffe107b6152ba22f77c9a0ae03b1ab3c055ccb64
SSDEEP 768:arv+4UNbdl3+PkKL2D4vjF669yrqUjWiIwwxMRjUiler:absbX31kvjF66INWZTMZUsQ
TLSH
T11903CE34AC589AB7CCF2D28672433783BFB4519396C50B98CADD270D469B4DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 32ae30b26907b976b96617c588ba86b2820c624cb4dbc4c2cccf6ed6436abd4b
MD5 a9f32548f4aa309260f438f675efc13c
SHA1 2f1542fa7ebed1f98b3f34db4b52c63634941665
SHA512 2cbd31556a7c6157d678794c0c3b6ff9ee8ff5a49d3f1226d74119f68e0168938ed6c23afb1ba23f4d847d1c6dadab3bf374596e527df82f49b6632b1fb4423c
SSDEEP 768:urv+4UNbdl3UNkKL2D4lTjF669yrqUjWiIwwxMA+Uiler:ubsbX3ZkFjF66INWZTM3UsQ
TLSH
T13303CF31AC589AB3CDF2D38672437683BFB4515392C50F98CADD670D069B4DA2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2abeb61a-9d66-4d22-9cc3-a15c4983e0ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2abeb61a-9d66-4d22-9cc3-a15c4983e0ad.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download