hxxps://outlook[.]office365[.]com/Encryption/retrieve[.]ashx?recipientemailaddress=kathrine[.]krekeler%40assuredpartners[.]com&senderemailaddress=sca%40scalouisville[.]com&senderorganization=AwGEAAAAAoAAAAADAQAAACWR%2bxlj%2b3VLkjMQogLcibdPVT1zY2Fsb3Vpc3ZpbGxlLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIwNUEwMTQsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTR2JOaYG30JApmJyBJ8a0UNDTj1Db25maWd1cmF0aW9uLENOPXNjYWxvdWlzdmlsbGUub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjA1QTAxNCxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ%3d%3d&messageid=%3cDS4PR05MB998381FD9F9398BDB5BEF09BCAA3CA2%40DS4PR05MB998381[.]namprd05[.]prod[.]outlook[.]com%3e&cfmRecipient=SystemMailbox%7b2C41C89D-35A4-465B-B69B-6F1FC54D8B03%7d%40scalouisville[.]onmicrosoft[.]com&consumerEncryption=false&senderorgid=e02e1bf8-a2b0-4185-ad67-277a72210cb0&customizationTemplate=OME+Configuration&urldecoded=1&e4e_sdata=Hp5ZdwjB027yAr16KnMnE8QiHsZmPxR79BH6mGAfMPuta4s90PS5z9WIeCEM8xYZN3JE68WeKFtR5oW3dtY8TRSexwLpDGaSJEohInoeuWgHN99cBHtwXaEdC2Xm0%2fZqk682MnUebfgTg8qBjh3PKKv2zgeunuJUwtDXYy6N4qHjzaDMakzOJ2iJwK%2bzbUOF%2fNYPmd281jj90%2brBMLogLAWc%2bBXPLiCuNDBUPblZpY2pqoGQmltOUxizHwTJ5H%2bOxKmS6zhc%2fXyh9GsNBLorqcgw1OULM33nwlJiOS%2bxNN8%2fb4iopWQkVBb6pVyYO0OH3YS8iYoWcagsPrQZ0tWkhw%3d%3d

Analysis

user interaction
yes
max time kernel
38s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=kathrine.krekeler%40assuredpartners.com&senderemailaddress=sca%40scalouisville.com&senderorganization=AwGEAAAAAoAAAAADAQAAACWR%2bxlj%2b3VLkjMQogLcibdPVT1zY2Fsb3Vpc3ZpbGxlLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIwNUEwMTQsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTR2JOaYG30JApmJyBJ8a0UNDTj1Db25maWd1cmF0aW9uLENOPXNjYWxvdWlzdmlsbGUub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjA1QTAxNCxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ%3d%3d&messageid=%3cDS4PR05MB998381FD9F9398BDB5BEF09BCAA3CA2%40DS4PR05MB998381.namprd05.prod.outlook.com%3e&cfmRecipient=SystemMailbox%7b2C41C89D-35A4-465B-B69B-6F1FC54D8B03%7d%40scalouisville.onmicrosoft.com&consumerEncryption=false&senderorgid=e02e1bf8-a2b0-4185-ad67-277a72210cb0&customizationTemplate=OME+Configuration&urldecoded=1&e4e_sdata=Hp5ZdwjB027yAr16KnMnE8QiHsZmPxR79BH6mGAfMPuta4s90PS5z9WIeCEM8xYZN3JE68WeKFtR5oW3dtY8TRSexwLpDGaSJEohInoeuWgHN99cBHtwXaEdC2Xm0%2fZqk682MnUebfgTg8qBjh3PKKv2zgeunuJUwtDXYy6N4qHjzaDMakzOJ2iJwK%2bzbUOF%2fNYPmd281jj90%2brBMLogLAWc%2bBXPLiCuNDBUPblZpY2pqoGQmltOUxizHwTJ5H%2bOxKmS6zhc%2fXyh9GsNBLorqcgw1OULM33nwlJiOS%2bxNN8%2fb4iopWQkVBb6pVyYO0OH3YS8iYoWcagsPrQZ0tWkhw%3d%3d
Sample260729-tydgdsbd49

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: DS4PR05MB998381FD9F9398BDB5BEF09BCAA3CA2@DS4PR05MB998381.namprd05.prod.outlook.com
phishing
A potential corporate email address has been identified in the URL: SystemMailbox2C41C89D35A4465BB69B6F1FC54D8B03@scalouisville.onmicrosoft.com
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4308	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298161748418726"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{A8240296-2922-40B1-9549-3516E4F276F0}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 3280	3892	msedge.exe	87
PID 3892 wrote to memory of 4308	3892	msedge.exe	88
PID 3892 wrote to memory of 2020	3892	msedge.exe	89
PID 3892 wrote to memory of 2020	3892	msedge.exe	89
PID 3892 wrote to memory of 2020	3892	msedge.exe	89
PID 3892 wrote to memory of 1504	3892	msedge.exe	90
PID 3892 wrote to memory of 1504	3892	msedge.exe	90
PID 3892 wrote to memory of 4428	3892	msedge.exe	91
PID 3892 wrote to memory of 4428	3892	msedge.exe	91
PID 3892 wrote to memory of 4428	3892	msedge.exe	91
PID 3892 wrote to memory of 4172	3892	msedge.exe	92
PID 3892 wrote to memory of 4172	3892	msedge.exe	92
PID 3892 wrote to memory of 4172	3892	msedge.exe	92
PID 3892 wrote to memory of 1380	3892	msedge.exe	94
PID 3892 wrote to memory of 1380	3892	msedge.exe	94
PID 3892 wrote to memory of 1380	3892	msedge.exe	94
PID 3892 wrote to memory of 3868	3892	msedge.exe	95
PID 3892 wrote to memory of 3868	3892	msedge.exe	95
PID 3892 wrote to memory of 3868	3892	msedge.exe	95
PID 3892 wrote to memory of 1704	3892	msedge.exe	99
PID 3892 wrote to memory of 4888	3892	msedge.exe	100
PID 3892 wrote to memory of 1704	3892	msedge.exe	99
PID 3892 wrote to memory of 4888	3892	msedge.exe	100
PID 3892 wrote to memory of 2608	3892	msedge.exe	102
PID 3892 wrote to memory of 4800	3892	msedge.exe	106
PID 3892 wrote to memory of 4660	3892	msedge.exe	107
PID 3892 wrote to memory of 2520	3892	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=kathrine.krekeler%40assuredpartners.com&senderemailaddress=sca%40scalouisville.com&senderorganization=AwGEAAAAAoAAAAADAQAAACWR%2bxlj%2b3VLkjMQogLcibdPVT1zY2Fsb3Vpc3ZpbGxlLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIwNUEwMTQsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTR2JOaYG30JApmJyBJ8a0UNDTj1Db25maWd1cmF0aW9uLENOPXNjYWxvdWlzdmlsbGUub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjA1QTAxNCxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ%3d%3d&messageid=%3cDS4PR05MB998381FD9F9398BDB5BEF09BCAA3CA2%40DS4PR05MB998381.namprd05.prod.outlook.com%3e&cfmRecipient=SystemMailbox%7b2C41C89D-35A4-465B-B69B-6F1FC54D8B03%7d%40scalouisville.onmicrosoft.com&consumerEncryption=false&senderorgid=e02e1bf8-a2b0-4185-ad67-277a72210cb0&customizationTemplate=OME+Configuration&urldecoded=1&e4e_sdata=Hp5ZdwjB027yAr16KnMnE8QiHsZmPxR79BH6mGAfMPuta4s90PS5z9WIeCEM8xYZN3JE68WeKFtR5oW3dtY8TRSexwLpDGaSJEohInoeuWgHN99cBHtwXaEdC2Xm0%2fZqk682MnUebfgTg8qBjh3PKKv2zgeunuJUwtDXYy6N4qHjzaDMakzOJ2iJwK%2bzbUOF%2fNYPmd281jj90%2brBMLogLAWc%2bBXPLiCuNDBUPblZpY2pqoGQmltOUxizHwTJ5H%2bOxKmS6zhc%2fXyh9GsNBLorqcgw1OULM33nwlJiOS%2bxNN8%2fb4iopWQkVBb6pVyYO0OH3YS8iYoWcagsPrQZ0tWkhw%3d%3d
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ffefc57c188,0x7ffefc57c194,0x7ffefc57c1a0
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,17607615914348395268,12702839831523449741,524288 --field-trial-handle=2248,i,7050702389019684475,1601645018663573033,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,5386332460100065652,10691615773782610247,262144 --field-trial-handle=2248,i,7050702389019684475,1601645018663573033,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,11155073651042629237,3572348042974923732,524288 --field-trial-handle=2248,i,7050702389019684475,1601645018663573033,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,3881665536434023491,18371290241602276745,2097152 --field-trial-handle=2248,i,7050702389019684475,1601645018663573033,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,3520444126399197143,14637296636155840561,2097152 --field-trial-handle=2248,i,7050702389019684475,1601645018663573033,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,9877304497399602299,5734611154314144351,2097152 --field-trial-handle=2248,i,7050702389019684475,1601645018663573033,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,10559272678300300304,16657896385165075237,2097152 --field-trial-handle=2248,i,7050702389019684475,1601645018663573033,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,14636966036637958178,2206345344536930743,524288 --field-trial-handle=2248,i,7050702389019684475,1601645018663573033,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,11935157556158207985,5175121897954580262,524288 --field-trial-handle=2248,i,7050702389019684475,1601645018663573033,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,13176633685504290030,2602165417286548862,524288 --field-trial-handle=2248,i,7050702389019684475,1601645018663573033,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,13176633685504290030,2602165417286548862,524288 --field-trial-handle=2248,i,7050702389019684475,1601645018663573033,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,2800043826465772682,2395254014529515190,524288 --field-trial-handle=2248,i,7050702389019684475,1601645018663573033,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,874622897053756366,6029688384922276023,524288 --field-trial-handle=2248,i,7050702389019684475,1601645018663573033,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,10430328510606936182,9130893050031663043,524288 --field-trial-handle=2248,i,7050702389019684475,1601645018663573033,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e3be576568781c62b0e29120af8f90ad13f7193f719579bd3616e15de74659cc
MD5 b865ee3d46d08f20536226b4891e4edc
SHA1 5702ee6a619696d6a5d3c4f6515d2d86e01e0323
SHA512 5afe4c7f202412f5a54f2a02e56b160f3d17a0a8335129ab848c74088647a520bfc16aaef03fef2f087c9add5213ea9568846f30bd0f1eb8ece49effa167629e
TLSH
T16F712B1904F10F51E3B26FF2CFD206DA3D324D888AA74C3242849B7E693772044E5905
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59401c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59401c.TMP
Size 3KB
SHA256 9a1fc4e705fc8283c026305cebe1c78198a1819020c2ab886e461a4b68850fc0
MD5 4d7b9d0ee1fa559174167c440fe51fc0
SHA1 1b87ad9fc713baef75d6387f85a7193f1158d91a
SHA512 f45e760be937edf5f0ab0ecf96d022729b146bf6e8c3fea4e021375fc2c02562782573cb57972598ca03ad6d40965ba1c4c0339f691efc3880d301cd69c18406
TLSH
T1FC713C1805F10F91E3B26FF2CFE21ADA3D734D888AA34D3202C49BBE593772084E5545
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7511d01e4994d051043e1515a6cc491e7acd5aa735fdec28948f58618dae5598
MD5 304b71355a896bdd451bfca448ff1aed
SHA1 9265f1eb0c1705ad3b97c4271cd65b45c116aaac
SHA512 94549e64d0c461a8e8e7a5e544574c70a35f670e9a75c292690e8d28284f40b001f939dfd2978bbd8056663af904ae3abaaa8ebdd338b3b836a5a7f36904294e
SSDEEP 192:sxZuRtyM/jK1Ml8Mk+/fWs4aaxIdpkFyHW6+WNaTIk/Yw0xyrIgrJ:sxZudM+/fWs4J6wyHbgT/n9
TLSH
T13B42E9066B34997BCCDBD209FA41BB53D6F90562E2904E44A9FCCA1C04E6BED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bf684f8a85e8397949dcc709fca917de87e89f034e857414ec7e372a986c78cc
MD5 444f6bf3347852710d6ecf2e003e25e1
SHA1 a064dd7140dab7c09d8c506ed545085a034d635c
SHA512 f8e2ea0be5c7093e94505cee496753a1b42fcf02e10dfaebce286eda0b18c4d42f435b08681238958b76925c877168dac164140d669aa9f1a1f35dae88acc23d
SSDEEP 192:sxZuRtyM/jK1Ml8Mk+/fWsmaaxIdpkFyHW6+WNaTIk/Yw0xyrIg54J:sxZufM+/fWsmJ6wyHbgT/ni
TLSH
T1BE52E8166B34997BCCDBD209FA41BB53D6F90562E2904E44A9FCCA1C04E6BED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2892dca1d165d7c5fd359ed3d40958b8f6bfc21339410d62b0c5a144f12abbee
MD5 85319519aed9eba309b7a4e0994dd46e
SHA1 1f19ee330ad25b7b15a0c7c727cfd58abf0bddd3
SHA512 2cacac7c4a8cbf4b1d66324b89fd96964fc24b2f506a02b5505da0bf48807584860debb2e5f25c87dab38920a54d311cf2041113d3c2050f29dda7e62f5403e4
SSDEEP 768:Be4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dqrohuc3aS:Be4jeXmWvmKLEu1jacPLZQdBbZ
TLSH
T14AD20A3B240CCB7E4F844E5CEC26AF976ED802CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8c164e7fffdb2b861520d6aa14b09dce55225a2db321c386b4927f6339915de2
MD5 c8493a9cecdd0a72a582bb056965fb99
SHA1 381b8b3248f91344e0c2f3fa5ac7f094294e7965
SHA512 4cb907585044ffe2b9d9c9309f77bc47e318fc64a08ad509f763ba0fa5be3f20b486881ae60e39ec6f6cb41d78a27ad9f5bc65cd683dc1fcd350ff1a61afff99
SSDEEP 24:Kd2fZKLaYdM404sY+/IjO0Ki3ha401EWkSmqM782yyXYQf3kVaadCC+4SO+lIjYf:KA7IVKMMAQyFpIxKCkUCeI/KjSMXy1z
TLSH
T16691C71279B712123C7D254893AAAA164B81B0A7705C757B7FAD00719F2BE650CFE8EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 053a3c7360799d7ca55b1ec9e54bd28aa9d793e7b4cb9da26f112fac1b37490f
MD5 24e084504de4de4b134320497ece2265
SHA1 070f62235c172381cba2c4b493069bb2e5e80dde
SHA512 185359cbec5ae84a89913e86994add3b39530d4345fd93404abd0b18dc388d6ac670a3b17f21ebf85a8698d9f6bef6ad6edc814a87f0a3e2d441e95eef7a7c08
SSDEEP 384:QZcIhsNit48IRW2Zf+o8hy9XPkdF5Scjmwzzo:uhj2h3Pk351jnk
TLSH
T1C6927E376D78AC6A5DE69145F48726138FF89123EAC86B84D5FC9F1D00D99AC0307D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b6d86a379d9aaee57b19a2217894778985538d534558fed598328b13b6ebf831
MD5 dfa834bf10ab6db805b573e42763b8dd
SHA1 bca1768f77b93873fcfe62779276d7a3d8b98846
SHA512 6a782c7a17f48210470d10cb117ed31c556f091cb2827cb3984e9906b67dcc1e37ce668b83b2827290134b4d2d6f57b6a11c6f524138a9cd2483c15c706360ae
SSDEEP 192:EONT6hZ0QmiUy1lpc/+jVSjzorh8F45wOZ0jU6:EONT6ocpu+o8hyH2SU6
TLSH
T11602D93968786C678EE2AE45F48727235FE5112BEAD56F84DAE81F1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ff2e30f307a41d182b30cfabb2400ed4c9a6cb3ace3d3ba33cf1fdfd09c9271d
MD5 5cf468edde8ed432b7ecc1305fc6e839
SHA1 5058e18083f2986cc6cccec1b2ff7dfb1816e1ae
SHA512 5d8770fc9797a459644d63d8555c51dd947ef1bcc93af5361b19a6a93b1b4faff0040d9ff23d8fd9ee641135d3e3cbb1d507e09329132d29033efac8323676fe
SSDEEP 192:xONj6hZ4QmiUy4ylbc/+jVSjzorh8F9XMEx5cOqQqTU6:xONj6cncbu+o8hy9XPU95U6
TLSH
T18C120B366868AC674DD1A585F48732235EE5522BEEC97F84D6FC1F1C00DFAAC130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0844d85ef30b9081e8cf47d3e6c54b09d289a81acb89fdaa6a5252f8d5351666
MD5 7cf30dbf702f0c18c8ab4bb1f6297eac
SHA1 c6a1aded224e8dcd579b06046bc5c540214d3b0b
SHA512 f76c5ca2eb68b4050834fd8b46b38e04ca93abb63c17532039bb0acab1390281ec180c483d07c510161ed119c6ecaeb381e315b1fd6fd8a5860fcdbacc5298d4
TLSH
T161415D58AAEA1148B3B36F56ABF7686D447FBD772F07945D00010D4F0A62B44C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads