hxxps://link[.]mail[.]beehiiv[.]com/v1/c/zytdOd2ZVQdvt/mW9aVw369VD/d8Fh8aKdrvTN7GdCdzB9Oc0SunA1n3XTrt%0ARdGNw3YCHzRpv2UuYoSsyVB9EOCud4F+8Rbv7bzbbBB1m0x1dNf59kHM3JEo%0AaotKJQaXO/dBrBtRCeITnW34rrx6NKjvQnEceQ7Ps80YK1RSIzE5ewalM2XN%0A3tTmNGtA8d8bgQjqtnwDyGKdKa97tFk8gw==%0A/34b192be8d9a31fa

Analysis

user interaction
yes
max time kernel
298s
max time network
276s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://link.mail.beehiiv.com/v1/c/zytdOd2ZVQdvt/mW9aVw369VD/d8Fh8aKdrvTN7GdCdzB9Oc0SunA1n3XTrt%0ARdGNw3YCHzRpv2UuYoSsyVB9EOCud4F+8Rbv7bzbbBB1m0x1dNf59kHM3JEo%0AaotKJQaXO/dBrBtRCeITnW34rrx6NKjvQnEceQ7Ps80YK1RSIzE5ewalM2XN%0A3tTmNGtA8d8bgQjqtnwDyGKdKa97tFk8gw==%0A/34b192be8d9a31fa
Sample260716-cdeehsaz3n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1944	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286406518708553"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{121870B5-62A8-474C-8844-CA91331B8FB8}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 1480	4500	msedge.exe	87
PID 4500 wrote to memory of 1944	4500	msedge.exe	88
PID 4500 wrote to memory of 1132	4500	msedge.exe	89
PID 4500 wrote to memory of 1132	4500	msedge.exe	89
PID 4500 wrote to memory of 1132	4500	msedge.exe	89
PID 4500 wrote to memory of 2252	4500	msedge.exe	90
PID 4500 wrote to memory of 2252	4500	msedge.exe	90
PID 4500 wrote to memory of 4872	4500	msedge.exe	91
PID 4500 wrote to memory of 4872	4500	msedge.exe	91
PID 4500 wrote to memory of 3224	4500	msedge.exe	92
PID 4500 wrote to memory of 4872	4500	msedge.exe	91
PID 4500 wrote to memory of 3224	4500	msedge.exe	92
PID 4500 wrote to memory of 3224	4500	msedge.exe	92
PID 4500 wrote to memory of 3816	4500	msedge.exe	94
PID 4500 wrote to memory of 3816	4500	msedge.exe	94
PID 4500 wrote to memory of 3816	4500	msedge.exe	94
PID 4500 wrote to memory of 4976	4500	msedge.exe	95
PID 4500 wrote to memory of 4976	4500	msedge.exe	95
PID 4500 wrote to memory of 4976	4500	msedge.exe	95
PID 4500 wrote to memory of 1164	4500	msedge.exe	97
PID 4500 wrote to memory of 1164	4500	msedge.exe	97
PID 4500 wrote to memory of 1164	4500	msedge.exe	97
PID 4500 wrote to memory of 4424	4500	msedge.exe	100
PID 4500 wrote to memory of 4348	4500	msedge.exe	101
PID 4500 wrote to memory of 4424	4500	msedge.exe	100
PID 4500 wrote to memory of 4348	4500	msedge.exe	101
PID 4500 wrote to memory of 2416	4500	msedge.exe	103
PID 4500 wrote to memory of 4576	4500	msedge.exe	104
PID 4500 wrote to memory of 4576	4500	msedge.exe	104
PID 4500 wrote to memory of 4576	4500	msedge.exe	104
PID 4500 wrote to memory of 1236	4500	msedge.exe	113
PID 4500 wrote to memory of 1556	4500	msedge.exe	114
PID 4500 wrote to memory of 4800	4500	msedge.exe	115
PID 4500 wrote to memory of 1932	4500	msedge.exe	117
PID 4500 wrote to memory of 1932	4500	msedge.exe	117
PID 4500 wrote to memory of 1120	4500	msedge.exe	118
PID 4500 wrote to memory of 4116	4500	msedge.exe	119
PID 4500 wrote to memory of 4116	4500	msedge.exe	119
PID 4500 wrote to memory of 2456	4500	msedge.exe	120
PID 4500 wrote to memory of 2456	4500	msedge.exe	120
PID 4500 wrote to memory of 4144	4500	msedge.exe	121
PID 4500 wrote to memory of 4144	4500	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://link.mail.beehiiv.com/v1/c/zytdOd2ZVQdvt/mW9aVw369VD/d8Fh8aKdrvTN7GdCdzB9Oc0SunA1n3XTrt%0ARdGNw3YCHzRpv2UuYoSsyVB9EOCud4F+8Rbv7bzbbBB1m0x1dNf59kHM3JEo%0AaotKJQaXO/dBrBtRCeITnW34rrx6NKjvQnEceQ7Ps80YK1RSIzE5ewalM2XN%0A3tTmNGtA8d8bgQjqtnwDyGKdKa97tFk8gw==%0A/34b192be8d9a31fa
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x2f0,0x7fffcce2c188,0x7fffcce2c194,0x7fffcce2c1a0
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,12617089753777341384,11621473708826887917,524288 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,907211459683606312,2548321718586374884,262144 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,811271260454693728,1926682811878406905,524288 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,3599581570268301595,2724557421611792399,2097152 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,67399600568907885,9758764937434143033,2097152 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,11217338460204049130,5491795966118946206,2097152 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,10238217728945114584,11685650495290314185,2097152 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3600,i,7933317700592804452,10437023130310400676,2097152 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,18339519468823343432,11190456422161705234,524288 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,4361368586805218036,60128122323696800,524288 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,16442252556075744436,4407213000681115842,524288 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,16442252556075744436,4407213000681115842,524288 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6060,i,8251478204931572955,15161413256953571676,2097152 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,15345628940628146763,16106489726280371076,524288 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,4167022495046751285,4468914236412888466,524288 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,5053148560260045888,2947609762171838941,524288 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,16751592289853703370,11496294482773761637,524288 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5224,i,7707745997374466692,17842271809638201676,262144 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1020,i,17420449442240148267,10644532648017145845,524288 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4048,i,17262064264636984476,9477896619019555191,524288 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,15760528630628372786,9185892897660495576,524288 --field-trial-handle=2412,i,15693883192445359754,5741049788030799304,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 266a4c40487f3ebb4596cda212fd80ee921ad0636a699ff27203fa3ed1df343b
MD5 5d957c8c8cf0445c7bc698f5a0a6bffd
SHA1 e8f6ad2e38a273d03b10d24b9aea5ee630e2dd1b
SHA512 9d1cb5daafa24c333a8e6f09c47aa10c3ba12046989939c8f6cca41905a59550fc45c8c9a3b24f26738a739b18fb6ae0e01856512c321beb6319cf1764b92a0d
TLSH
T18661930CD902D941F36E273CFCD122D836B285D85EF39E1932B069BC7617BA191FA448
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c21eb69af38eb0b77b4f72c1a19fe3f6b9775412684101e53b68cacf4b9f1356
MD5 a81817a01173699d1952df48b392b100
SHA1 0d76e81c1b943de3dba0f337245a1f387843b02c
SHA512 16905f0cf7a363ba9162f3d9389533ae0c3c435a29cfa8b4f080b622ec6955e9257bca55eb164263d321bbeb4529690224cc19f63f8ea8cc4696cc1f8229cf2a
TLSH
T11831AEF3C3D9856DC90527F0AB24AE1BCE2D0A1582183C2AC9D5EF5BD3E2475E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5acd3fe45850e38c1817cb7118398ec9dcea426b2bb2de03a7d96de0c1420487
MD5 2817caf3426d274040251f434f94cbef
SHA1 13f8a53cf3cc31b172b9baa43851e3c1011c6abd
SHA512 d5ef334e417b2c41a10f2af294f8a7ca06d07336f3d7c32d5a790823a8252df2e7a07a4d3e5810434641652033b48e60fe22b38ddda332ecbe26c103ffd0a114
SSDEEP 192:sxZmRokH/fzsdAQIdpYvHW6+WNGYLzV+10IgrJ:sxZm1H/fzsdAxmHbGDe9
TLSH
T12622C9126E28A93B8CC7D20DBB25BF53D6F9503265951E58E7FC960C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0b6dab1c5d321cf0839d24d9837ac6ba754556fcd059cdd9cb17cf9f76039663
MD5 260cf2602f64415c127e1894d1c4eac8
SHA1 4963a8b57b84ff6469a80724f88276f8fa9e4230
SHA512 a330a07a65568f8eef949f3a908bf9f41ac1b6db5f8e258303e843d353bc883c4c07db2c69e648957e6ec5a2a58302565a9f61168afccda26e294d5e58534d2c
SSDEEP 192:sxZmRokH/fzsw5AQIdpYvHW6+WNGYLzV+10Ig5hJ:sxZm1H/fzsw5AxmHbGDe1
TLSH
T13E22C9126E28A97B8CC7D20DBB25BF93D6F9503261951E58E7FC960C05E66DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6bc032ea1b077562b7a8bd0148c46155f163d18b166fec72f73b1b79ba45dffa
MD5 4075d15c9d3546af36682feb56c8a7b1
SHA1 1ebe622b73fa7a14307de265bf7e8380def265ad
SHA512 a4d3e417911c1b460f07bd645ef9e9bf11a53f0a262d38f89aa7c1191eebd600980695a0031c6cc5cd169a99cd4d2d1ff02bdd44f6e2fee6d0833004be503abc
SSDEEP 192:sxZmRokH/fzsw5eQIdpYvHW6+WNGYLdT+10Ig5bJ:sxZm1H/fzsw5exmHbGJeb
TLSH
T13522C9526E28697B8CC7D20DBB25BF93E6F9503251951E58A7FCD60C05E7ACE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e1e7a4990d52c2503a4524ce27ed32a999ff5691cf327372a752a64e0c5a0faf
MD5 0334d5a2c35ea4d6964bcb2bc2ff0daa
SHA1 f5de29390d3030ae88c6b9d0d14b9f0015d0c109
SHA512 7751b5ca87c5a66b909a1901d96d3879477d21010d9e99b29a2e81e10054ff5714a3ffec092f006ac02ea2b78e2c9a1f2c42018b70465496f798303abbf06a57
SSDEEP 768:2JO6fP1Wvxz3j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkILlWwJvpro2Od:2JO6fP1Wvxz3ju1jaZILIsvCPd
TLSH
T13CC2F93B240DCB7E5F801A9DAC5A6F973E9802C7AB588D4047FE854C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 ad5c1639aa7e11c2d12705cc6f92851a7462324ae18763a5898c4947e0ba4be5
MD5 46eada2b9cd550c3d510cd5c4e19a892
SHA1 1aade8e8031cc7c20021a8e34006bbb7df24e74f
SHA512 dbfd0eab784ba9d395e95279059b08c9118e71a4e5e4721115f649d1b568f7e40ff0d9dde622716123a306279bc99e2e4ba1f9eb0645fd088f1bf8df42417512
SSDEEP 96:KUAAKtePGbGKYcaG5CKSMt5iKqgS+VWKGkRs:iiJt5DpB1
TLSH
T1E0E10112717F06473DBE2A48A39487274742B163702EA52B3BE850714E6BE350DBDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47a056b7-8068-48f3-82b1-f5dbd5a26367.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\47a056b7-8068-48f3-82b1-f5dbd5a26367.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7cc9af5e5638169f75f98d13d42d84e993f7ad309589015fb62c44d95a8a29d0
MD5 474c8c27be0f972f462293ae9230c26d
SHA1 67538b71cc8edf2ea743b8ff700fdc6eaa3091db
SHA512 31949294ae4cc9097578c7eff8b8c243aee0c4058a3ea2f46beb3baa00ba5d75c0b5b1396b9d622ee22e75949b5f63cc3a9888b3deb4d1eea16ec550f2af5744
SSDEEP 384:2tNn/s3n9SfsNiL9eoYa9LOdlzRNOObjI9G6w7Hdn:2j+9UjB9O3zRN29M9n
TLSH
T1E0929D32683C5D735DE39195F58B3A079FF4517B978A2E80D5DCAF0C02CB6AC1316906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 f8e8e42c6124b9e0024ac618555ce035081f998b15dec16046c01713d28ac491
MD5 14f7b66176d45496db319287518b2fd6
SHA1 cd076d413488483fb3c7c740bdcea5eb3df6c587
SHA512 e82517bbdb57307ad258f272b207fab1e2287a7b5949e5161ebf5578ecbef499ef03d92257207055e65265463714667e3703ac201b9b33cf951ead4b636c437a
SSDEEP 384:ziF1tNn/s3n9SQzsN68TUNTUlIlW9eoYa9LOdlzGNOObjI9G6w7Hdn:eF1j+9fbwg2B9O3zGN29M9n
TLSH
T1DAA27D3368589D77AEF29A95F54A36179FF401BBC68A2E80E7DCAE0C01DB1EC1306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7e420e17db0f43ece35b57be279d55538444026ac6ac4b8b32a85755239e16fd
MD5 542425fd4efa6724e8aa1fef75a6a690
SHA1 5ca17d8d200a0c37105bf2ea115990b32681b807
SHA512 a5a0353649c2b873620967f20cead15ad2840b97da3204169c7f1f2a4a622efef2826c99f020198009cb5a75ed09a4672764c460981db58b2b9b14dcb3f75cd1
SSDEEP 192:qONC6O7+3hQmiUyBfGttb0CO2bCygGKuU6:qONC616Gt9LOdkpU6
TLSH
T1A502F8357C7C6CB79AB2AE45FA8767135FA5103BE9962F80D6E81E0C00D765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a566a213478dde6723b27e73eda441c0e1d237adc23ba4be5c6e97f706828787
MD5 e4d19810a479ee600ab44e542e832a09
SHA1 3eb4ca60c82ca2552472fd407662a3d43f27d9d2
SHA512 298abea36a50cee5944ef4f1664603aeb57ba07b35324744f99132a9c79dba2fa4e204802b4d86c5d9d85cba1cd7daa92655468b1a18fe117c3b7f66f500d895
SSDEEP 384:UtNn/s3n9SfsNiW9eoYa9LOdlzRNOObjI9G6w7Hdn:Uj+9UqB9O3zRN29M9n
TLSH
T1FB929D32683C5D735DE39595F58B3A0B9FF4517B978A2E80D6ECAF0C02CB6AC1316906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ffcd29046ccafdf3cdbeec39d432d6bc3dc05529ff1cdbff0be9f6955493612e
MD5 f7d4c11dbe664bb96f994a8a06c7e073
SHA1 232f99d00b7aa1b83b9a0e69863804f7b0a7ff13
SHA512 2ea5a7980433fd3e0905c0ff276f55941966c1a06ecd377cfbe5ba06626577c1b4cfa716a7964418b2e39eef9ccc8595f133381969f097f4918d7bb3a370d0f4
SSDEEP 192:9ONb6O7+3mQmiUyNfottb0CO2bClwEEcNGrq9nU6:9ONb6kAot9LOdlztNU6
TLSH
T178120932786CAC775EE2A584F98776135FA5012BDA8A2F81D5DC2E0C01DF6AC234A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6d136b23dfe3ff3edff3681c7aa8209ce4eeed8ff179f93eff037b0ac600af5d
MD5 13990c5d3ca03e424b6ecd4a9dd7ffbf
SHA1 b9d07a130c131388353a51eae5d356a637aa3722
SHA512 1cd7123761eddafa9040ddfee5f6a6e01d328f781211d7744865da4333716ef124c12577a2d2aba858d5df191f3fc7c0c00f10a6006c0da506dec8ecaf8f0070
TLSH
T179411A5CA6F91108B3B77E0AABF6646D587F79372E0A946D10110E4F0A66E40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download