9a4945716908cc2dcbe138c0504b944e90f291abb3acb61fcd815d8f301201f6

Analysis

max time kernel
299s
max time network
254s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 2KB
Sample260903-ppfsyas1cs
SHA256 9a4945716908cc2dcbe138c0504b944e90f291abb3acb61fcd815d8f301201f6
MD5 696805482c1c7250be14251626e3bf06
SHA1 a8990d71a4cbd62218dfcc3488a6da493d9bbe20
SHA512 648d8a7ae4ce13904f322bef4a6b87ba99c6080221f0bf99aa6b0c8ae30a345641b5516fc8c72c236d638cbc7831690ee0b324263fe75782241ca9e8c451dccf
TLSH
T13341C9D2E5409C9E64B30076E060BB58C3C2A64677370EE4F99B747BA9D25115FF3349
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
784	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329122296389539"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{DF242126-3825-4F83-B580-1579323A6D6E}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 1216	460	msedge.exe	85
PID 460 wrote to memory of 784	460	msedge.exe	86
PID 460 wrote to memory of 4404	460	msedge.exe	87
PID 460 wrote to memory of 4404	460	msedge.exe	87
PID 460 wrote to memory of 4404	460	msedge.exe	87
PID 460 wrote to memory of 1580	460	msedge.exe	89
PID 460 wrote to memory of 1580	460	msedge.exe	89
PID 460 wrote to memory of 2076	460	msedge.exe	90
PID 460 wrote to memory of 2076	460	msedge.exe	90
PID 460 wrote to memory of 2076	460	msedge.exe	90
PID 460 wrote to memory of 2608	460	msedge.exe	91
PID 460 wrote to memory of 2608	460	msedge.exe	91
PID 460 wrote to memory of 2608	460	msedge.exe	91
PID 460 wrote to memory of 4804	460	msedge.exe	92
PID 460 wrote to memory of 4280	460	msedge.exe	93
PID 460 wrote to memory of 4804	460	msedge.exe	92
PID 460 wrote to memory of 4804	460	msedge.exe	92
PID 460 wrote to memory of 4280	460	msedge.exe	93
PID 460 wrote to memory of 4280	460	msedge.exe	93
PID 460 wrote to memory of 412	460	msedge.exe	97
PID 460 wrote to memory of 4376	460	msedge.exe	98
PID 460 wrote to memory of 412	460	msedge.exe	97
PID 460 wrote to memory of 4376	460	msedge.exe	98
PID 460 wrote to memory of 4396	460	msedge.exe	100
PID 460 wrote to memory of 2128	460	msedge.exe	114
PID 460 wrote to memory of 1000	460	msedge.exe	115
PID 460 wrote to memory of 2276	460	msedge.exe	116
PID 460 wrote to memory of 1148	460	msedge.exe	121
PID 460 wrote to memory of 1148	460	msedge.exe	121
PID 460 wrote to memory of 4620	460	msedge.exe	129
PID 460 wrote to memory of 4400	460	msedge.exe	131
PID 460 wrote to memory of 4400	460	msedge.exe	131
PID 460 wrote to memory of 2128	460	msedge.exe	132
PID 460 wrote to memory of 2128	460	msedge.exe	132
PID 460 wrote to memory of 1836	460	msedge.exe	133
PID 460 wrote to memory of 1836	460	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ff929a2c188,0x7ff929a2c194,0x7ff929a2c1a0
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,8517024047046624042,271861108349646047,524288 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,10437028931424273502,9071405261917365637,262144 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,7201441170168308925,2860246213110987302,524288 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,4109111214114458288,11201528708079694082,2097152 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,14981467522540211634,1874172451317165127,2097152 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,2906844954737213181,13418028767284308031,2097152 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,10008815979742309194,2002160554523019067,2097152 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,6941211467261801080,9301988310647069522,524288 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,15394165197716870206,18187363192460837400,524288 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,15755881888295818659,325954169076921379,524288 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,15755881888295818659,325954169076921379,524288 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,4596016347622777432,11463512407012873465,524288 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,918512879494424087,4312105904481913801,524288 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,6008710533337270042,14414962156059594749,524288 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,2045332321909257865,6402214295525557956,524288 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5964,i,16864948878404228970,15912714771779387940,262144 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,10087730379928388082,5419228254326306972,524288 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,9368441574310412400,10856802283948416954,524288 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,10663530513944842851,5672308936169025835,524288 --field-trial-handle=2268,i,8096010062651221391,15607269181866707204,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:8
  2⤵
  PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 184fe1fd98190bb493e20eb3868a67dda0c003aed703ceadbb3bc571bea168c7
MD5 ab067f7f1f63efe6849761e2d986431c
SHA1 ffe8b0a0c03ba70f2d446fe1574afb1cdceb6166
SHA512 33a014e02cccf2085b7186aabbc879037b7dfd751f85ea71b0eb8d55e9fd05d178197235dfd42299d266071b628c996419cfcad3e8712f4269233b46fbf84a9f
TLSH
T1F4714C4211567C77EFDA0AF1F4CD4209B8F1CEA50E531FD6155CB8BD9827B63809AA0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590093.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590093.TMP
Size 3KB
SHA256 10c8ade1ed2fd31745fc1e7b925c200dce8d9cdae8595582d11cd3771d390254
MD5 e6cdf4371f55c057f08c4efb8a1907b9
SHA1 4bb27369c9365214c659ad0abf499b20c053cdd0
SHA512 fddedd09e153dba17d2d76e29e2ee27bc9cf1aae87b3f31f9064ff4fa893849fe11ad3d912578519a7ef6d9b20dc00df3a60f18abdae4176180b454e29d5422e
TLSH
T133714C4612567C77EBDA0AF1F4CD4209B8F1CEA50E531FD6159CB8BD9827B23809A60B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 478B
SHA256 569c187d3c78ba07b68152013c09c0a49143208f5a8d48a2b4dd157056bf565b
MD5 9324a946f2c6647f5c68d3d1e440e3c3
SHA1 4faee60ef946ec372e955d5b7e9e25474553c514
SHA512 1a924b7055f53ef4d70bb531cd39b033c892015a12858f6d370af8c1e5f592381bb55f1776f0a2825d1e5077720ee8cfa4c265a3a1c8a1c23e7c8452247aad6b
TLSH
T130F09EF383E0596E8A0042F05518AE17CE2D0402431C7D55C5D4AE2B93E3074D40099B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b725673f12713b3832ef43983586e02c4d911d2092957c07e33f631d69b6d4f1
MD5 c90fafdb0244d268768cb83782dc5f8b
SHA1 a33feb603094a94303553c13542e22f757ef187d
SHA512 8c953030c912ea9005a9db1faec7c883eb49a47d9a06af52a52eb49d409779af0692edce520a682676304982c3fe41b4b03870196c5a86bdce29f5a1ef9cd0fa
SSDEEP 192:sxZr/yM/jK1Ml8MkB/fis+4PfxIdpdaHW6+WNGY4wkAEjIgrJ:sxZr7MB/fis+EiAHbG79
TLSH
T19542F801AA34A977CCDBD209FA517F53D5F94572A2900D48A9FCCA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 baa5d141f85a8685fff0d05580722eeb1291cee389f5521e159a2f8eb2e5f3f5
MD5 680001848092d548bfcb848d1fd95caa
SHA1 a7afdfc18fa4338a6a3da5df3d4a0ca09c93f715
SHA512 8dd8de617b511aec160ca2a97631fbd74f71fc6592118124fa94ee95ced72024e3149575c41bdbb767584e25c05a2b3f26b387f6551f64f9eef04f5aea6e1acc
SSDEEP 192:sxZr/yM/jK1Ml8UQ2kB/fisY4lofxIdpHaHW6+WNGY4lhAEjIg5cJ:sxZr7qdB/fisY2oi6HbG1e
TLSH
T10352D811AA346977CCDFD209F951BF53D6F9547292500E48AAFCCA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1e5ea8e109efd83381f32a06ddcd284505598a25f4f34c3a5c6aded92890bf15
MD5 34862b91f979227802d9fed52ac4e545
SHA1 119759df53459cbba12a25327a5328b51f96df3d
SHA512 58a069f54426f9015154a2a6c3dbfc85893e148a333132c39fb2dacf81d925f05b74c7b981769bee2dc6258cba56253335fd8b27c9ad1394b54cba2afc375a1c
SSDEEP 768:tN8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opderopk2UnB:tN8iJPNWvx76ru1jahALocd1fUB
TLSH
T13CD20B3B680CCB7E4F844E9CEC266F966DD801CB5B948D5447FA884C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a10e466bd5b28645c00c47f2db8d6341ae09326722b4a7ecf44e63f3ff9e1987
MD5 40944de36af37a05ceab5b18c22523de
SHA1 34d25e6e334e8c987568470fb4362b8820080a69
SHA512 1b6a97348547e7eccd112c364be6ad3d87b85c24d61824abc26d3af09da0bed37b5547fe6db88795082edffdd5646ea14e54b97f35c8f200fe6a6c2fd85dd584
SSDEEP 96:KgvmbPVdd+PtklFv+K9LFR+p3v8B/fs4AKdGm0AKtmuSM:DvmbPVddItkfvvLFRU3v8B/fpu/f
TLSH
T132914212727B02C23C3F2519D262872B9B9172673414EA2F37A901728D67E294EFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d041d303-9c22-42a2-813d-b7cba7dbd674.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d041d303-9c22-42a2-813d-b7cba7dbd674.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d0a60d498a4cfb5bc9068287c6dcd197c92d44ffad212b06afcf3051f77417fd
MD5 22963a311630e49ee7d87323880b6956
SHA1 3a21c00ea9c556acab9f3f861ab92baca4acb0ac
SHA512 5567bfce4556c72fa5e77e49b9c481846f633156eb91769cabb9209f379d7611b2503ab382dde2656328e49391e04e60879221a7a58d13cc97fea33f80991261
SSDEEP 192:uam+xasuheOwQxMGsN51LQe5pgm4MQmiU1GA/TL4k03M6NkqLI7qkqva+4LcYLWc:gZcIhsNzLHBLM2UkBgk3rsa+VYVBZsoF
TLSH
T14F828D3268746C7A9DF7D641F84737174EB8C157E6CC6F9485EDAB0C04DA398130AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 40f26e43b35d64624612918af022990edcb3bfea05dd540e8721a1c1f1252ac2
MD5 0050ae91a1225aa61a3409cb632fe273
SHA1 3f1873fb0af69836ba6544e914b1ee21e0f6984c
SHA512 4c9807e1fc05d73486c55c4daf6ad94cadab2d3a953f7e8184ae59fb4aaa4889fa2eadbbb61f57bb2ef9c0da17fd70b0391fd961eb35f86f23717e0c7c5589b8
SSDEEP 192:uym+xasuheOwQxMGsN51gQe5pgm4MQmiU1GA/TL4k03M6NkqLI7qkqva+4LcYLWc:sZcIhsNzgHBLM2UkBgk3rsa+VYVBZsoF
TLSH
T1E9828D3268646C7A9CFBE641F94737174EB8C157E6CC6F9485ECAB0C04DA398130AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 12c2d12af71024fc31cb18dc14a3a100024cc170023641332046b849124d032e
MD5 3f8ce5936a67a2fc50737b1b45589b90
SHA1 6b83259ead02c5b0d3133a2174db905203bdeb88
SHA512 eb13d48b1c32b5a9902b7f59480a9730a06a5cb8043e37efd18de83ee7f6bcc4d70ffbe13d903973bc9249feaa91f4859580afb1a0b0db6ec2df0cfd038c4383
SSDEEP 384:miFiZcIIsNN8TUNTUlIlgHBLM2UkBgkErsa+VYVBZsoF:NFQIEwgSi24rhg+nsC
TLSH
T1FBA28D335C94987EADBBDF45F94633178EF48167D6C9AA94D2D89B0C00DB2D8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b036bdcd3d7c5ebc2661a610b81e6427fe1bedf0465a1dc05b456ddabae5ec52
MD5 a60d8c2b9e1c5e8c2238227c57960f13
SHA1 cd137392cf7c5e1f6eff7829c1cc39e4100956aa
SHA512 6bb9bae5ff15238401914f08245e63a51bc40dfae2148fffee2fc54b1db9fdc5cc44dc97fb5a3290b3b1cfc92f80d25fff52dddce570d12b4168e31e026fe7dd
SSDEEP 96:ZqONkWQsjpfmUTmDK5ih/cIPURHl8h4otop525D1BhPwivh50xy0SFYK+AxADqQX:gONS6kDfQmiUyQLZ903SQiKFjU6
TLSH
T13802F93568782CABDEA3AE45F48737275FE5212BEAC52FD4D5E81A1C40D724C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 54de892947fe233a9010518122a561dc4b40215a6068cf045b118262551f7132
MD5 dd6081e80f4991c0b34b090965436f4d
SHA1 b927215142dd7aae4834da385178c10583f874a3
SHA512 2d2516bb3b5de067dd77e4246a41a55c37e5c9aafad8e715f6fb7e60d90f3a33dba7a08fd5512ca6432e3e974b2cde15aa7de483d83a86e4616f20c2128e3501
SSDEEP 96:0qONka7QsjpfmUTSK5ih/cIPURHl8h4otop52xJD1BSPwivh50xy0SFYK+AxADEa:/ONdE6kfQmiUy6ZL0903M6NkDcR7qkU6
TLSH
T157121B3268B86C6B9EA39945F08337175EA58227EBC97FD4D5DC1A1C04DF25C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8781a6de-23f8-48cf-970e-89f8e82c83d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8781a6de-23f8-48cf-970e-89f8e82c83d4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3d0829a78881b1d41e316e4492fc583ba22764d65e7b7cbff5d4ccf7d9f1e815
MD5 42f2d82362f7f4993b9a8734dfda472b
SHA1 b6b1bc22a495744d3fcf55e1001e5a805d2b341b
SHA512 9ac4f0466c0d95be5afa9a6a7fffb72cd03b45009488732ca6b2cdee34c5fcd28812c3a412a2c457ab6cf18e5aeaa40d03269bfd163e97af2b6311b258f11fe1
TLSH
T187411758A6F91148B3B76F5AABF6986E487BBC772E16D45D00110E5F4A32A40CCA2733
MD5 SHA1 SHA512 TLSH

Submit Download