hxxps://mailtrack[.]io/l/0b715240bcbb47b3dd0d99e069083cefbda882a0?u=14198190

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mailtrack.io/l/0b715240bcbb47b3dd0d99e069083cefbda882a0?u=14198190
Sample260710-j3pecafy2j

Score

5^/10

microsoft discovery persistence phishing privilege_escalation

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
67	5036	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5036	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281447848144409"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{91C3EE5C-0310-4845-9102-01CA5AB6D91C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 4832	1332	msedge.exe	87
PID 1332 wrote to memory of 5036	1332	msedge.exe	88
PID 1332 wrote to memory of 4872	1332	msedge.exe	89
PID 1332 wrote to memory of 4872	1332	msedge.exe	89
PID 1332 wrote to memory of 4872	1332	msedge.exe	89
PID 1332 wrote to memory of 1944	1332	msedge.exe	91
PID 1332 wrote to memory of 1944	1332	msedge.exe	91
PID 1332 wrote to memory of 3548	1332	msedge.exe	92
PID 1332 wrote to memory of 3548	1332	msedge.exe	92
PID 1332 wrote to memory of 3548	1332	msedge.exe	92
PID 1332 wrote to memory of 3272	1332	msedge.exe	93
PID 1332 wrote to memory of 3272	1332	msedge.exe	93
PID 1332 wrote to memory of 3272	1332	msedge.exe	93
PID 1332 wrote to memory of 1932	1332	msedge.exe	94
PID 1332 wrote to memory of 1932	1332	msedge.exe	94
PID 1332 wrote to memory of 1932	1332	msedge.exe	94
PID 1332 wrote to memory of 4260	1332	msedge.exe	95
PID 1332 wrote to memory of 4260	1332	msedge.exe	95
PID 1332 wrote to memory of 4260	1332	msedge.exe	95
PID 1332 wrote to memory of 1456	1332	msedge.exe	99
PID 1332 wrote to memory of 1456	1332	msedge.exe	99
PID 1332 wrote to memory of 1456	1332	msedge.exe	99
PID 1332 wrote to memory of 4744	1332	msedge.exe	103
PID 1332 wrote to memory of 2776	1332	msedge.exe	102
PID 1332 wrote to memory of 4744	1332	msedge.exe	103
PID 1332 wrote to memory of 2776	1332	msedge.exe	102
PID 1332 wrote to memory of 4780	1332	msedge.exe	105
PID 1664 wrote to memory of 2572	1664	sethc.exe	113
PID 1884 wrote to memory of 4868	1884	sethc.exe	118
PID 4188 wrote to memory of 4960	4188	sethc.exe	120
PID 2456 wrote to memory of 2116	2456	sethc.exe	122
PID 1200 wrote to memory of 1368	1200	sethc.exe	123
PID 2460 wrote to memory of 3488	2460	sethc.exe	124
PID 1332 wrote to memory of 1340	1332	msedge.exe	125
PID 1332 wrote to memory of 1340	1332	msedge.exe	125
PID 1332 wrote to memory of 4240	1332	msedge.exe	127
PID 1332 wrote to memory of 4180	1332	msedge.exe	128
PID 1332 wrote to memory of 4868	1332	msedge.exe	129
PID 1332 wrote to memory of 4880	1332	msedge.exe	131
PID 1332 wrote to memory of 4880	1332	msedge.exe	131
PID 1332 wrote to memory of 1088	1332	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mailtrack.io/l/0b715240bcbb47b3dd0d99e069083cefbda882a0?u=14198190
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffd22cec188,0x7ffd22cec194,0x7ffd22cec1a0
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,15607341361124176094,16943143821387298171,524288 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,5569086558142257139,9897627859846740909,262144 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,4993972023979845703,9211862518430925738,524288 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,6591987535718538718,13725917106243954486,2097152 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,13325862713239404793,16953750308642906292,2097152 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,16809538136970005546,6495119335143251432,2097152 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:2
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,3205728417081158699,4061008800808974266,2097152 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3468,i,1860164775827030724,12032039177792063935,2097152 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,8616851254865860839,2289061486103231071,524288 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,13182348619675270222,4428017129212748496,524288 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,1231401079851932197,6711232261877868718,524288 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,1231401079851932197,6711232261877868718,524288 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,3655110950865772011,17664733043667528390,524288 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,2012217551252814216,17139946934964387979,524288 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,14527650344798515588,18011045595090198057,524288 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,7053250365125947249,3345731831691025286,524288 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,13810303388607461832,13746251205638257358,524288 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2068,i,18133402977201897875,14207073536111603519,262144 --field-trial-handle=2232,i,1600939315532736646,4719021582782579025,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2220

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\system32\EaseOfAccessDialog.exe
  "C:\Windows\system32\EaseOfAccessDialog.exe" 211
  2⤵
  PID:2572

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\EaseOfAccessDialog.exe
  "C:\Windows\system32\EaseOfAccessDialog.exe" 211
  2⤵
  PID:4868

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\system32\EaseOfAccessDialog.exe
  "C:\Windows\system32\EaseOfAccessDialog.exe" 211
  2⤵
  PID:4960

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\system32\EaseOfAccessDialog.exe
  "C:\Windows\system32\EaseOfAccessDialog.exe" 211
  2⤵
  PID:2116

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c0 0x500
1⤵
PID:1192

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\system32\EaseOfAccessDialog.exe
  "C:\Windows\system32\EaseOfAccessDialog.exe" 211
  2⤵
  PID:1368

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\system32\EaseOfAccessDialog.exe
  "C:\Windows\system32\EaseOfAccessDialog.exe" 211
  2⤵
  PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

01dd775b-3d78-46ce-9ce1-014b005c037f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01dd775b-3d78-46ce-9ce1-014b005c037f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 efd72e35e096a1903364b5242ee4228c014d81fa78388710e4f60351ad60496c
MD5 32e0b6fe19a2253e7612787cada6dc48
SHA1 60065c9746661d28b234e728d9cfc45d4514652f
SHA512 daeac7067e1ff46cb7bf2a6aedd277a8bd80f3e7da632b1a8f16ffdcd1f909d7e091fcd0fc2a64f5d3d0ff87c53dbf60318b0468c5f2a07d6913741b2155db21
TLSH
T1C271C9F804D279A0EFDC0D3090E205957EF785E9FB737E85509469706E15761426B13F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2d419032cc41dfad850e6ee1459fbaea0f7f6eb9a1e4bdbc1c39a74f3feaf31a
MD5 a85c0496ec1395d97bf52b4532c37bdf
SHA1 db605da29ce18414a200f4d40361f0a9d78437e9
SHA512 0cf66591d0ecfff15589db076c21f4a9f94ce44e3970009590322ad3decbc5e286f7e913a09dd46aa72bd897c03a8b15c3513957f1e5120096e8cac93acd6fd7
TLSH
T1815189F393E4826EDA1152F4AE146E1BCE6C0901431C3D5A85E8EE5BA3F2474E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e596f6f348b070c88c5faeebe47beae198d4b5cd430c286df257402623c0ef62
MD5 e76b5bd28e3ffeb36141caa4ed36068d
SHA1 790111c4f4c7b780edaaafc399c0b6799fa69e2b
SHA512 3de27d53bf7f796dec75d6b2d608aa918ebb6c857b8c560977898ff9b76445e40843cf1ef2f2fc9f9dd163b715560b374c8cd81f8ae80320fa1514ff9fc35cdf
SSDEEP 192:sxZvR1yM/jK1Ml8MkY/fysYd4XIdptlHW6+WNwtq/YCNZuZFIgrJ:sxZv3MY/fysS44nHb//+/9
TLSH
T1BB52C7126A349977CCCBD209F955BF53D6F90573A3940E44AAFC9A0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 884e4ffbe8be96fc9e33d8a5775f447aee45b749f972baa24d973ffdef0ae209
MD5 245397ffb9a3bf011c3fd8472cb075c4
SHA1 34222cfe4f6e10579e6eb1c14453862991b10a5e
SHA512 8abcaf9ff1b5ec4142da6de6b55f65315153f423de0894aa1cab75c53da66092eb3be0d291bc28ceb293dc5f608e55bdf2a6f3cb2da61271617b5bdc25af1434
SSDEEP 192:sxZvR1yM/jK1Ml8UQWkY/fys7d91IdpruHW6+WNweC4ZYCuvFZFIg5BJ:sxZv3q9Y/fysp9GCHbU4Z0/p
TLSH
T18052D816AA385977DCCBD209B941BF53D6F90473A3940E44AAFC8A0C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3f0fd4a9749d783d458bfca465c324bf9a3a1de39add56ee8a594d79e01e5848
MD5 952cbd7ed6910d2c8c22384c63855619
SHA1 ab3958eb9b037b1ec8b90b69aa1419d663a9da8e
SHA512 ecb9de906a740998a0d24b902d3025603acf80ee4972ce3e9ff20678fefff2da4676d1988cf8bda2b1ebf05259a520dfce05df9f38a0f5d2dd74a3f169a2eff1
SSDEEP 768:j48bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKV4ro4:j48bqn+WvSCt6u1jaCZLbWVD4
TLSH
T198D20A3B280CCB7E4F845E5DEC266F962DD801CB6B988D4447FA894C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 347734f1020e331133adc5da28897dc851e45475fdb47aee9a91b5eafd5d7c06
MD5 98f5f8d96217106142348a0c4c0784a5
SHA1 91002c7b8c699933ddcfecc4a88fe91c331c2c8d
SHA512 b2da4f9fe2e94273a127c9b099149dfea89199f52c0086c45dea37b5c8c060efdb114d18facb7148ac494fb4629f59bdb56d00d108368f0849b4b315cb9e65b3
SSDEEP 48:KQJI5Ky8sjyhOIXKzacnyhjgXz1xFgRZSzI+bgKz1btgHrwsCNp3sTXh55ez:KQJSKy8KyOIKzam64YKBWA3sTXh55ez
TLSH
T1C991E017303A4292687E2548F3979A365F8235A33158E86F7FB804921F67E224DBDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54d15630-8b8a-4c0d-890b-b43b4b7bc85f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\54d15630-8b8a-4c0d-890b-b43b4b7bc85f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 873e585840d5062819a5ddcdf9d92e6a9e3930f0feb3862f5c5fae253f9dea2e
MD5 16eda2c726d7039b6e171f77b4fd08a1
SHA1 7900e5bba86799313561f689064396cf4646f08a
SHA512 3a7f2116dcdc09f64e2b8c8cdcbf4ace64ca6ea9b5cfaecc533d3eabc42eb723785fad730d7f957e9b5705cb9cf219c6a31f1386d156143494bb77f66c967e7f
SSDEEP 384:WtNn/s3n9SfsNJvnT60DuwdEa+SdPId+2eWrOObjI9G6w7LUA:Wj+9Ui60ZOan2dleG29M1
TLSH
T19D928D325C388D775DD25559F4872A278FF8817787CA2F84E6EC9F0C01DBAAC4316815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c1749ae395c0c500491e4ba68ac61567af6998a98410fe8f87976562b1bde363
MD5 9724a56505fdb812086366b1f50f8d81
SHA1 02ff83f0863dd1b47262426b7d633af4bd3778a4
SHA512 7165f645be16b18c9309a6366e5687d8663b7dbb0b7a1bc36d7220d56d61a5b59fce3f2eb008c7977c9a21284e6e5afc1c1abf9c9b9c70015c7183840f0b1df6
SSDEEP 384:sGiFKtNn/s3n9SB2sNr8TUNTUlIl0nT60D5+dEa+SdPId+2aWrOObjI9G6w7LUA:0FKj+9LiwgE604Oan2dlaG29M1
TLSH
T1B7C229F208E78936E99E4B57B77E2D138EBCC167B6852A40F7984A0CCC9617FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 05232ae02802021b55c3fb72735289dfe4d5452ec38106e1085b6cb4e4e7cc93
MD5 4d2f6ff0245a21af08d20d574c5d616f
SHA1 dfbe1aa6d691c0c523036c2c93dfb9be77baf616
SHA512 0bea897788a5add97585685877fde1bf8115e9e53367e698b43502b1a118aa4308570d81bf85331108f15c3346b6b93760b63b90214c8a03526a95f842ce2044
SSDEEP 192:vONGV6Db6QmiUy34HBa+jx+FdCYHojRgBipU6:vONY6udHBa+SdPIa8pU6
TLSH
T1F402D93568786CB79AF26E49F88727239FD41077DA962F44DAEC5F0C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e88246ace5f1ce150114e8ac625e4c90ce23fbc7adf909ecd307ff7b7f7d82ad
MD5 3dcb3839c90e68a92c76148eceefcbf1
SHA1 af8b5783b49e90aa3bcf805e65cd5724170be379
SHA512 4f335d5172e3a9f8ad657513fe7a4384b5e37a3eadd723bc1d3fc90d7963387af98b50d76a7cb17067738d32a33c950790b06a07a455ec2d0e884d417b458a43
SSDEEP 384:9tNn/s3n9SasNJDnT60D5wdEa+SdPId+2PWrOObjI9G6w7LUA:9j+9ZS60GOan2dlPG29M1
TLSH
T172928D326C389D776D925559F4873A27CFF8816787CA2F84E6EC9F0C01DB6AC4316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 47d53cdb6269005f486e544d7bf7080638d32214f50bad989b8b7405e1fa29b1
MD5 83826ace8cefb8a6889c3752ac6836d5
SHA1 53b4670ba364743eb1c924e30f7c24c20eee259f
SHA512 85c328f4b0acb0b4a62eaf5dedd4c1fcdc46f6b1a97399108030972bc3a90c2e64ce58c73bc0e9da9e4e26a42f8f4684ed8ef88ae5966a85fe50a246f2b46821
SSDEEP 384:TtNn/s3n9SasNJ0nT60D5wdEa+SdPId+2PWrOObjI9G6w7LUA:Tj+9ZR60GOan2dlPG29M1
TLSH
T19B928D322C389D776D929559F4872A27CFF4816787CA2F84E6EC9F0C01DBA6C4316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bd3c6a4d570cec87a2582efbfc882925fdde0358c384a674aa45f7b8e06aacd8
MD5 5cdaa29454d8a64cf3f90419ad1f858c
SHA1 d127993f48047e2d2e615d54b57c8d8ab55b8365
SHA512 b2b9da6314f524e7d01e5023408fdca998217704b721a51b934db2d132634d83be693aaf337f8bcb2417ee835d568b8f7e98885fc98f4b5c4b9c8e8bae57d736
SSDEEP 192:FJONk6DbYQmiUy24/Ba+jx+FdCYHodX+2pNzzqtrU6:fONk6gm/Ba+SdPId+2fWrU6
TLSH
T15E12093668389C7B5ED26955F48736139EE49127DA8B3F95E6EC4F0C00EB66C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6f3b311-a475-41bc-ad34-8ede0b243c04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e6f3b311-a475-41bc-ad34-8ede0b243c04.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4cbe1173e19ea2d65f8dfabfd15f9e550652048cb102b04463c7aac2148a38d1
MD5 a72af8afe9b67a92474b2891a0a391df
SHA1 13483c9a3dda7e6e832ba11d9d580cd47e0dd4cc
SHA512 c33a19ad74d6fb7c8b11c8f02bb66fbf0d5edcf27c67910daadffd29937b7115af40c5e75f7844d2b7a6aeea798bb13612c5fa2efdd2eba3525f8976430a3040
TLSH
T18441E958AAEA1144B3B76E599BF664AD487F79673F07D49D00010D4F0A63A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download