7d4e0bf25c177756e272c968d40cf011474d905af0f2c69fee1ae8a0bcd78770

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261009-1258-e4s6h0.html
Size 1KB
Sample261009-tdcdlabh78
SHA256 7d4e0bf25c177756e272c968d40cf011474d905af0f2c69fee1ae8a0bcd78770
MD5 607cd0e6263781f92e65bb89441252d7
SHA1 e7a9bbd8bdfceddfb6d5941a00ea4e3cefeb25b8
SHA512 1bea41d508cc631a7c1cdf5c6b3acd97a1af5b6379ba2622cf794f2ecd74dd0dd4526354a2ea9cf44db2e54ffd9b7d94f63d77f6217ac620e6e4b6f2e6605057
TLSH
T12221031D79D29004E573F1369F1BF00C96685E07998EED05758CC5823F92BA705F9F98
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5968	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{AEC32F15-CBA4-4966-A7DA-85B4FF1E57BE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 1176	4736	msedge.exe	87
PID 4736 wrote to memory of 5968	4736	msedge.exe	88
PID 4736 wrote to memory of 6036	4736	msedge.exe	89
PID 4736 wrote to memory of 3556	4736	msedge.exe	91
PID 4736 wrote to memory of 6036	4736	msedge.exe	89
PID 4736 wrote to memory of 6036	4736	msedge.exe	89
PID 4736 wrote to memory of 3556	4736	msedge.exe	91
PID 4736 wrote to memory of 3960	4736	msedge.exe	92
PID 4736 wrote to memory of 5412	4736	msedge.exe	93
PID 4736 wrote to memory of 3960	4736	msedge.exe	92
PID 4736 wrote to memory of 3960	4736	msedge.exe	92
PID 4736 wrote to memory of 5412	4736	msedge.exe	93
PID 4736 wrote to memory of 5412	4736	msedge.exe	93
PID 4736 wrote to memory of 3220	4736	msedge.exe	95
PID 4736 wrote to memory of 3220	4736	msedge.exe	95
PID 4736 wrote to memory of 3220	4736	msedge.exe	95
PID 4736 wrote to memory of 4040	4736	msedge.exe	96
PID 4736 wrote to memory of 4040	4736	msedge.exe	96
PID 4736 wrote to memory of 4040	4736	msedge.exe	96
PID 4736 wrote to memory of 452	4736	msedge.exe	98
PID 4736 wrote to memory of 452	4736	msedge.exe	98
PID 4736 wrote to memory of 452	4736	msedge.exe	98
PID 4736 wrote to memory of 3816	4736	msedge.exe	100
PID 4736 wrote to memory of 3816	4736	msedge.exe	100
PID 4736 wrote to memory of 2864	4736	msedge.exe	101
PID 4736 wrote to memory of 2864	4736	msedge.exe	101
PID 4736 wrote to memory of 5668	4736	msedge.exe	103
PID 4736 wrote to memory of 3868	4736	msedge.exe	112
PID 4736 wrote to memory of 3868	4736	msedge.exe	112
PID 4736 wrote to memory of 3868	4736	msedge.exe	112
PID 4736 wrote to memory of 4928	4736	msedge.exe	117
PID 4736 wrote to memory of 5512	4736	msedge.exe	118
PID 4736 wrote to memory of 5096	4736	msedge.exe	119
PID 4736 wrote to memory of 2908	4736	msedge.exe	127
PID 4736 wrote to memory of 2908	4736	msedge.exe	127
PID 4736 wrote to memory of 2908	4736	msedge.exe	127
PID 4736 wrote to memory of 3080	4736	msedge.exe	128
PID 4736 wrote to memory of 3080	4736	msedge.exe	128
PID 4736 wrote to memory of 4172	4736	msedge.exe	129
PID 4736 wrote to memory of 4172	4736	msedge.exe	129
PID 4736 wrote to memory of 2512	4736	msedge.exe	131
PID 4736 wrote to memory of 2512	4736	msedge.exe	131
PID 4736 wrote to memory of 2512	4736	msedge.exe	131
PID 4736 wrote to memory of 4268	4736	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261009-1258-e4s6h0.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8687ec188,0x7ff8687ec194,0x7ff8687ec1a0
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,18151713773511052145,12650645232256232065,524288 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,11525976495208049319,18377146681494553589,262144 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,6204840325063400914,7869350295247994029,524288 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,12187875024336643642,5985597134366089267,2097152 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,16921087708485945742,14784855899136167873,2097152 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5000,i,14410534614097601650,13262477331923226125,2097152 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5104,i,13783530745576331104,11488831390500881624,2097152 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3608,i,2626531594980532282,7135473209970208126,2097152 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,3503911846508627293,8094369731488730799,524288 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,12150155143285041629,1616366470130647857,524288 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,15234529852016653002,9049646775149062855,524288 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,15234529852016653002,9049646775149062855,524288 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6080,i,17980628017213951191,17004465148761764928,2097152 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,2195359642311572453,11578800879963781283,524288 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,16898227324664762276,14195647484958549203,524288 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,14843845240784198754,2254162856318495647,524288 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5316,i,1027895440553521399,4842372088243704108,2097152 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,7431091431621763147,15028695095265556210,524288 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,14490913623435078962,12562658903546137518,524288 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=760,i,1812150756165485891,10965915610028311729,2097152 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3536,i,3980435090887808248,11847268207748145169,262144 --field-trial-handle=2384,i,1945866690247653732,5915331869897891598,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3122f64f-0f6a-49a8-9e71-b8892692a727.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3122f64f-0f6a-49a8-9e71-b8892692a727.tmp
Size 26KB
SHA256 5d17ec5ff3c0416e4a775344ea69c8e662745907b9ea9bdaf3d6faec0549ef77
MD5 8d23b6faf48b53626968a1f2cbed6afa
SHA1 ff2f51f08114bd4398dd64c5619ae2dd1a6d95b6
SHA512 acebfd20071a5624743ad7095d8b7c9f36cba3c43201a5ff516fd117eeda0425e5defeb63742a340e0259c30b8c4fcbac92e53d7c529bfb73a3b4b56d20fdc6a
SSDEEP 384:niiFiZcI1HsNI8TUNTUlI4z5mgmOPsU4zf8BWFAnLtt78WnfCgL/7IzE:pFQBxwgbBqBWFi5tQWnf9
TLSH
T175C23A32EC64DA7BECEB8A95B78A3A43DEF05123D6CC9AC4D5D85D1D009719E030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a17b4a3-eabc-4647-b84c-cc170c6ca122.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7a17b4a3-eabc-4647-b84c-cc170c6ca122.tmp
Size 26KB
SHA256 252b0aafb8364422cfdfc592f309652c40a55db02929ab528353563c1d4c1e4e
MD5 cb8704bd644f400a5d45492f5a7a8867
SHA1 9c071345a671a52feba9854e40ecda2c9ae6ac26
SHA512 5f2502925e2737d4a040f22e16e80cc76c1c8f34630cf00c552fc3d3628941713f07e56dfa03355569bd78c038ac800a3768725459c418348cfb8135e088df1b
SSDEEP 384:nLiFiZcItsNI8TUNTUlI4z5mgmOPsU4zf8BWFAnLtt72WnfCgL/7IzE:mFQtxwgbBqBWFi5tyWnf9
TLSH
T131C23A32EC64DABBECEB8A95A78A3A43DEF05123D6CC5AC4D5D85D1D00D719E030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85713c36-16d8-432d-ab0f-50172ba7426b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\85713c36-16d8-432d-ab0f-50172ba7426b.tmp
Size 26KB
SHA256 d62d2d9bd2452da69efd331b89887ea922e38b205258faad12d09f9e0eb9ebd6
MD5 11314128ee8b3bea68c8d9d369cc26d0
SHA1 cb2001249b322a16594048d2c951e1344cdb4190
SHA512 717aa9ace3bad803db825e1ef54339250d4164fb6889b838eb3040190b2cb0e3302215b8b58b7ad7ee6b6913bbc89a9d84003b2b4710e9b8f77f752976abf4f3
SSDEEP 384:n4iFiZcItsNI8TUNTUlI4z5mgm5PsU4zf8BWFAnLtt72WnfCgL/7IzE:DFQtxwgb2qBWFi5tyWnf9
TLSH
T12DC23A32EC64DABBECEB8A95A74A3A43DEF05163D6CC5AC4D5D85D1D00D719E030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

16973ce0-193d-43aa-9cd9-e368dd626efc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\16973ce0-193d-43aa-9cd9-e368dd626efc.tmp
Size 11KB
SHA256 175e8590dd448d33e5754f738613a4a70b258bb7f16e4c5a293a13738b3444cf
MD5 2dea38bb27e26e4fdebb9083847178f2
SHA1 952a152ffce51b0045e7b6c4a52f68cbc8e76c5d
SHA512 e90a2f454b95c110fcec32fa499abd90570ece4d1b5fe59bc9fbf95d37208e47da5e5ade512515cef9a11883f1b4360af5c545415c0c9c48adfaf958603729b3
SSDEEP 192:sxZaRfkk/fEs3QZZ5vzodpH7PHW6+WNGYbIaLYGJsIgjoJ:sxZaWk/fEs3OZ5krHbGFUYG2jM
TLSH
T17142C615AE28A93B8CC7D61DFA55BF53D3F91032A0951E84A6FCCA1C14E76DD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34037a90-2446-45a6-bb8a-4491427c4981.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\34037a90-2446-45a6-bb8a-4491427c4981.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61e34588-829e-4b4d-a343-1c76c7e9669d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61e34588-829e-4b4d-a343-1c76c7e9669d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

62195d7c-3904-4ab9-9be5-ed6921e77074.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\62195d7c-3904-4ab9-9be5-ed6921e77074.tmp
Size 414B
SHA256 bd1dbd83acfb081823301107753a8f743effe7325e86a4eb49782aa0a5e86092
MD5 03a796f764d80fe297795d9258c33c1c
SHA1 b01dc65d84d458b7caaf717add6319fe51191780
SHA512 7f8ad9d6e97aadfaf00d39426687c7d9cf9a4c0a7b7b5918e0ae73ee457211a836cec4313fa83620962a953da99ddb19dc07ebeedb3c592e73ea2fa86d9a6a6a
TLSH
T19FE0ABE4CC19BD3708FE175800900685EB0103073B81848B773C800C8FF16B74586AEC
MD5 SHA1 SHA512 TLSH

Submit Download

9320f943-45c2-46f8-8eb0-3996f99bca95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9320f943-45c2-46f8-8eb0-3996f99bca95.tmp
Size 11KB
SHA256 fd40b60d53afe0951ad8edd99a6acbecf8587d6f364a390f7e26be83dea9fbec
MD5 6a129e9a14d40fb32f88e24129e28184
SHA1 96abbf3cc40c94adcb82c8d241e35611cae4ef4c
SHA512 d80c734be63a198d60f587dc2c6942dfb278c0edd490d7355ac6d2bca51cb17052a2999fce9a053dccf270f6b8a5ad00e5c2b98f6a72902f47c38c8e26553e1f
SSDEEP 192:sxZaRfkk/fEsNQZZ5vzodpH7PHW6+WNGYbIaLYGJsIg5poJ:sxZaWk/fEsNOZ5krHbGFUYG23M
TLSH
T10342D615AE28A93B8CC7D61DFA55BF53D3F91032A1D11E84A6FCCA1C14E76DE220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ce217447c0cae921953159f50181772c4ddd343ec2f86ebf02566fcd330282ce
MD5 6d213a5e6dfb5a79b7ec00acaf509bc0
SHA1 6a408455a8009e059d41dae12aa09a85b5d65684
SHA512 b072cbb8330a789a09f248bcb316acde370882b94474d8224b374769a4606826f2d5a306e2288b6899e5b30b73f2f23a85879318cce57e9b8b4334890ef047d6
TLSH
T159E026E828D9C22FE20C7447027CDB0CCB80375B93C1B92F2700CAC57446844B2C26A0
MD5 SHA1 SHA512 TLSH

Submit Download

609a6ca0-f97c-46a8-9523-fcd2a30ac9e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\609a6ca0-f97c-46a8-9523-fcd2a30ac9e4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3c0e2082-a932-4456-ae6e-74b44ab4c849.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3c0e2082-a932-4456-ae6e-74b44ab4c849.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a04b9db6-8393-4211-a081-fab91e77fb7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a04b9db6-8393-4211-a081-fab91e77fb7d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a0659f75-5cbd-4c77-910d-434b4b9f1264.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a0659f75-5cbd-4c77-910d-434b4b9f1264.tmp
Size 1KB
SHA256 1faedd24e0513852ea36d10b540f8a440d9a3010e3daf9f1468d20a51405c325
MD5 5df39e66b4a61998231aad158b36ddda
SHA1 c39fbaeee4928c758b8abd7c2d8677fecb6fcb2b
SHA512 24eb010139f90b64051c6640863c462ddb33b39201270914ed7dfa81f7c6f609f082d7b1f33187c264e283d01815e4335d93abdb9b29ab2c99b3b15b5c7c3062
TLSH
T19731CFF7C3E8866E890196F0A718AE2BCE2D0954432C3D5AC9E4EF1B93E2471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f7de539fade50b7c8b015468ecd2105cbb17b7fe190db093dd6dbfd8b8348ee7
MD5 f38c0e63377c82795053e8b65b0b3e76
SHA1 74cb1a80e001ec36b77fecd7a6a2344dd09104bf
SHA512 b66da004063c892102077ca8360919df94828044368a7339741fd4b42dd37d6a243662500be2465b4bd6372783ed7d790a4d03b84c46c2b0d190aec159510824
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvX+A1D:OtfFvpopPxrB4Rhf+ED
TLSH
T1CCB2231471BB421138FE690881B6972F064232B33159E63B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

afa1b19b-408a-4ad7-91c6-336aeb04f872.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\afa1b19b-408a-4ad7-91c6-336aeb04f872.tmp
Size 11KB
SHA256 1f3fcb927e738927e34348de1baea95f2d15842e6c0d5f2875d19e98f1d32ee5
MD5 dba8ac48652a1ee3160b1233c9a07aa2
SHA1 34353804181f3253bce5f96f45a173bc1ef466bd
SHA512 0f613e48bbf540f93324d1bf91bfdd36341f7bd3247703502ea71b35a90797bb87687f90bbe5993c48b25b758f7f618cc975758e863af01a319d411e3aaabe60
SSDEEP 192:sxZaRfkk/fEsgQZZ5vzodpH7PHW6+WNGYbIjLYGJsIg5poJ:sxZaWk/fEsgOZ5krHbGF/YG23M
TLSH
T12342C6156E28A93B8CC7D61DFA55BF53D3F91032A1D11E84A6FC8A1C14E76DE220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d634a97a-efc6-491e-8df2-0b5a880e2451.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d634a97a-efc6-491e-8df2-0b5a880e2451.tmp
Size 25KB
SHA256 56243d53612bab10d278ad68b078f75d1cbd96f3af00b4b1e5d3573289bc8b58
MD5 8a26312051e3fd47012f62fcebb64176
SHA1 73f623eb92e24c4704af2c4d8ce5f33d02270c16
SHA512 5e4de95151a266bd1f33d273698b1787426d85e7e2a29d65eaa991402bf10ddf0eafb7dbbb4e7df75fc6dfbe2dc35ecce107658cc3085bfa266967bba65b8c61
SSDEEP 384:noiFiZcI63sNT8TUNTUlIm25mg5Un4zf8BWFAnLtt4isa+VYqgL/7IzNo5:zFQ632wgSfJBWFi5t4ihgVO
TLSH
T1DBC24936EC98CABBECEB8FD5AB4A7A47DEF00163959C59C4DAD85D1D008719D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f3b128bad9c876596c246d486f0277ac44d21008b57f13062bd3bbc33167233c
MD5 f2911d3a0bf0e6bab9688d6c72460cf3
SHA1 5fe257188b45637d9b6ef8bc2e749d377d6db5d3
SHA512 6441cadbe294f3cc1eedfb79b44b57b1bd989049e701daba2510c5f99328425793addf03b2f6fc4b36fccc1768ce13b975b1ae54287a45f5945c69ee605a3e80
TLSH
T100412B58A6E91158B3B77F5AABF3986D487BBC772E06D05D10010D4F0A27B00C871B33
MD5 SHA1 SHA512 TLSH

Submit Download