hxxps://protect[.]checkpoint[.]com/v2/r01/___hxxps://mandrillapp[.]com/track/click/31400482/www[.]trustmarkbenefits[.]com?p=eyJzIjoiOU9sdWRaVmprSHFLVXd2dzhQQ19OX0I5QncwIiwidiI6MiwicCI6IntcInVcIjozMTQwMDQ4MixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy50cnVzdG1hcmtiZW5lZml0cy5jb21cXFwvaW5kaXZpZHVhbHNcXFwvdm9sdW50YXJ5LWJlbmVmaXRzXCIsXCJpZFwiOlwiMjIxM2QyYjlhYmM0NGJiM2I5ZTIzZTQzNGQ4ZmEyYjBcIixcInVybF9pZHNcIjpbXCI5MjJmOTZmMTRlYzFkZWZiZGRhNjJmZWI0YTU3ODM3Mzk1ZGU1ZTZiXCJdLFwibXNnX3RzXCI6MTc4NTQxOTQ1OH0ifQ___[.]YzJ1OnRybm86YzpvOjhhZjRkNTQwY2JiODdhNDUzZjc5Y2Q4ZGFlYmEzY2ZmOjc6ZTFlMDowYTlmNTMxZGE0MWE2YzJhNzllMzkwYTE5ZDQwZDJkNWNlMjY3MjEzNTEzNzhjYWFkMzMyMWU4YzYwNmU4NDgyOmg6VDpG

Analysis

user interaction
yes
max time kernel
31s
max time network
33s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/07/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://protect.checkpoint.com/v2/r01/___https://mandrillapp.com/track/click/31400482/www.trustmarkbenefits.com?p=eyJzIjoiOU9sdWRaVmprSHFLVXd2dzhQQ19OX0I5QncwIiwidiI6MiwicCI6IntcInVcIjozMTQwMDQ4MixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy50cnVzdG1hcmtiZW5lZml0cy5jb21cXFwvaW5kaXZpZHVhbHNcXFwvdm9sdW50YXJ5LWJlbmVmaXRzXCIsXCJpZFwiOlwiMjIxM2QyYjlhYmM0NGJiM2I5ZTIzZTQzNGQ4ZmEyYjBcIixcInVybF9pZHNcIjpbXCI5MjJmOTZmMTRlYzFkZWZiZGRhNjJmZWI0YTU3ODM3Mzk1ZGU1ZTZiXCJdLFwibXNnX3RzXCI6MTc4NTQxOTQ1OH0ifQ___.YzJ1OnRybm86YzpvOjhhZjRkNTQwY2JiODdhNDUzZjc5Y2Q4ZGFlYmEzY2ZmOjc6ZTFlMDowYTlmNTMxZGE0MWE2YzJhNzllMzkwYTE5ZDQwZDJkNWNlMjY3MjEzNTEzNzhjYWFkMzMyMWU4YzYwNmU4NDgyOmg6VDpG
Sample260730-rrnyfaag92

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4092	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298951645654585"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{C1FFFEEB-F54F-4280-91F3-89500E8B39EC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 4744	4288	msedge.exe	80
PID 4288 wrote to memory of 4092	4288	msedge.exe	81
PID 4288 wrote to memory of 1216	4288	msedge.exe	83
PID 4288 wrote to memory of 1216	4288	msedge.exe	83
PID 4288 wrote to memory of 4560	4288	msedge.exe	82
PID 4288 wrote to memory of 4560	4288	msedge.exe	82
PID 4288 wrote to memory of 4560	4288	msedge.exe	82
PID 4288 wrote to memory of 2956	4288	msedge.exe	85
PID 4288 wrote to memory of 2956	4288	msedge.exe	85
PID 4288 wrote to memory of 2956	4288	msedge.exe	85
PID 4288 wrote to memory of 4536	4288	msedge.exe	86
PID 4288 wrote to memory of 4536	4288	msedge.exe	86
PID 4288 wrote to memory of 4536	4288	msedge.exe	86
PID 4288 wrote to memory of 5048	4288	msedge.exe	87
PID 4288 wrote to memory of 5048	4288	msedge.exe	87
PID 4288 wrote to memory of 5048	4288	msedge.exe	87
PID 4288 wrote to memory of 1952	4288	msedge.exe	88
PID 4288 wrote to memory of 1860	4288	msedge.exe	89
PID 4288 wrote to memory of 1952	4288	msedge.exe	88
PID 4288 wrote to memory of 1952	4288	msedge.exe	88
PID 4288 wrote to memory of 1860	4288	msedge.exe	89
PID 4288 wrote to memory of 1860	4288	msedge.exe	89
PID 4288 wrote to memory of 1152	4288	msedge.exe	90
PID 4288 wrote to memory of 1152	4288	msedge.exe	90
PID 4288 wrote to memory of 1152	4288	msedge.exe	90
PID 4288 wrote to memory of 1936	4288	msedge.exe	93
PID 4288 wrote to memory of 4464	4288	msedge.exe	94
PID 4288 wrote to memory of 1936	4288	msedge.exe	93
PID 4288 wrote to memory of 4464	4288	msedge.exe	94
PID 4288 wrote to memory of 1212	4288	msedge.exe	96
PID 4288 wrote to memory of 3664	4288	msedge.exe	97
PID 3664 wrote to memory of 3248	3664	msedge.exe	98
PID 4288 wrote to memory of 992	4288	msedge.exe	99
PID 4288 wrote to memory of 992	4288	msedge.exe	99
PID 4288 wrote to memory of 992	4288	msedge.exe	99
PID 4288 wrote to memory of 2340	4288	msedge.exe	100
PID 4288 wrote to memory of 2340	4288	msedge.exe	100
PID 4288 wrote to memory of 2340	4288	msedge.exe	100
PID 4288 wrote to memory of 2724	4288	msedge.exe	101
PID 4288 wrote to memory of 3052	4288	msedge.exe	102
PID 4288 wrote to memory of 2144	4288	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://protect.checkpoint.com/v2/r01/___https://mandrillapp.com/track/click/31400482/www.trustmarkbenefits.com?p=eyJzIjoiOU9sdWRaVmprSHFLVXd2dzhQQ19OX0I5QncwIiwidiI6MiwicCI6IntcInVcIjozMTQwMDQ4MixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy50cnVzdG1hcmtiZW5lZml0cy5jb21cXFwvaW5kaXZpZHVhbHNcXFwvdm9sdW50YXJ5LWJlbmVmaXRzXCIsXCJpZFwiOlwiMjIxM2QyYjlhYmM0NGJiM2I5ZTIzZTQzNGQ4ZmEyYjBcIixcInVybF9pZHNcIjpbXCI5MjJmOTZmMTRlYzFkZWZiZGRhNjJmZWI0YTU3ODM3Mzk1ZGU1ZTZiXCJdLFwibXNnX3RzXCI6MTc4NTQxOTQ1OH0ifQ___.YzJ1OnRybm86YzpvOjhhZjRkNTQwY2JiODdhNDUzZjc5Y2Q4ZGFlYmEzY2ZmOjc6ZTFlMDowYTlmNTMxZGE0MWE2YzJhNzllMzkwYTE5ZDQwZDJkNWNlMjY3MjEzNTEzNzhjYWFkMzMyMWU4YzYwNmU4NDgyOmg6VDpG
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffc4a27c188,0x7ffc4a27c194,0x7ffc4a27c1a0
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,4739306939710036293,701748613158806218,524288 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,15281593074265018284,9649292856384999592,262144 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,6244307878239652857,16900630923887948793,524288 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:13
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,9130566780806877682,14354917738620280347,2097152 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,15479269953382799565,14459249673881593239,2097152 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,5941519451273683450,15277226630364152029,2097152 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,14087516730126210180,6262615791561274998,2097152 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3460,i,17288533699027192754,15629623325385059903,2097152 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4276,i,7485405127586363838,7149493910758605271,2097152 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:9
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,11863918969033589093,12331590377899696439,524288 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,3001587219129319079,3001382587675982925,524288 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,4901164618715416186,6959714121633753104,524288 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,4901164618715416186,6959714121633753104,524288 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,4985074703219161116,14579854395443518681,524288 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4212,i,1028825084315795598,4275319113839545586,2097152 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3964,i,12655396959886064328,18209745877966770159,2097152 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,3213004361681832153,12858593242388339068,524288 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,8076080012322975763,4195409130642562886,524288 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:14
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,8089984561488472088,7938717294987431847,524288 --field-trial-handle=2096,i,1337434035788410828,2905541170661198094,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:14
  2⤵
  PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d7b11206-8e4b-4a22-9223-48d67feb972f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d7b11206-8e4b-4a22-9223-48d67feb972f.tmp
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 28626508baa13a07a2362e6f2a203726fde87b7701be8da2aadf75c6fefb8db7
MD5 97460e74b4c472c1b20116eac4d5e2a8
SHA1 57c51b227fc7c6284755f81fa247741b7d5bb770
SHA512 c235b32b321b6226b72679bbf24f9b53d0709867127daa19ba5204972f573521547123cc8200ff3b8fbd1889bb7e88206acb7f52d7b197c6436f9814ec222ad6
TLSH
T13871A51DC0627773E3914731D8F301F07DB5B49E194F0E951C2C58BE6AF67518C18268
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586f3f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586f3f.TMP
Size 3KB
SHA256 e23e922bb5dccdb7acd73cd3952636f3a62ca9927ebb1a074e7b656ea7041e96
MD5 f6dedf098e833242449a5baec0632b63
SHA1 f04ad22252a39d406daba8ee786397df5b90ee88
SHA512 864ea26dbc76804948fcb0691719a59effcfaff4d4a4f035e21744110663e8d135a42fb83098073d70d7f071174a21fbabbedd28d2eaf6303c16e237c1bf2eaf
TLSH
T11071922DC0627773E3918731D8E301F0BDB5B49E194F0E96082C58BE6AF6B528C18268
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 2466749384f1d49528136d184886aba0760a8b77e390ae689876983fc06ddbcd
MD5 f44a96da6013ca003d871afad193fcb9
SHA1 c3a72c5dde98dd05946201e43a23154a15755694
SHA512 079c8b1219a0c2beedbc6d29ffeb0c5d819d39561e44d53b78884d8f53a2bc0668f3fb1497b6210e4955dc70c7490a40cbdc518b70e25ca132ed4ee4c7005c67
SSDEEP 768:4ll1j83r2pmWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33ALl/C80/hProcH:4ll1j83r2pmWRmeKQBCu1jaK3ALpCN/3
TLSH
T147E22C3B680CC77E4F844E5CEC26AF966DD801CBAB684D5447FA894C03C73EB512A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e89f93ccd75f9a5e8dd231e5d00ede2c84851aca50bb3867ae315ff367853d35
MD5 7dc9abfb14d32e7ccd207fc727aa72f9
SHA1 4dea3f7f8cbfb6b298a3ea860d92cbc7cec2e386
SHA512 382bf2510b13e368a365b9ad005759bf75907e70306f623a6bb9d48fa2fa8e92108e6babb4caf9090654aa629a1ba62efe9660d67d06912c97d7051119ef51c5
SSDEEP 96:KkUgKtem27GKEAmuvaKswHioKvaGiqYKXK8JktZ3T:6v1tlXbXhJktZ3T
TLSH
T15DE1261230BF22423C7E2518A655872B1B52B3733118A5AB7FA950B60E27E342DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bae5c14c-7c5c-4f38-ace1-49336c428742.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bae5c14c-7c5c-4f38-ace1-49336c428742.tmp
Size 12KB
SHA256 72d462df8ad4508d28472100c0f61b513d342972ac18d164aec927577764674e
MD5 bfe28f36c3f947c70e814bd8382154ec
SHA1 5dfcac71ee2cccdda69d41fa0a0e3b431722b9b5
SHA512 abe0e39676ef17eed9357d1f34a3dd7b3fbf6acca21120cee843a3f8ab30c659bd7c95826a295abfef262e4ee6c1a55e7d95a46bc9cd1e8f470c4850ebc6b4c4
SSDEEP 192:sxZQRfvyM/jK1Ml8MFs/fisuXmvyyIdpM/W6+WNGY0Y8eWzAqIgrJ:sxZQ1pds/fiscmvOM/bG5LWq9
TLSH
T17142E8066B349977CCCBD209FA55BF53D6F91472A2900E44E9FCDA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8a8a55d-1733-4cb3-9a51-31b58303fbde.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c8a8a55d-1733-4cb3-9a51-31b58303fbde.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c6043b9393d854b98986c3423e095fe2fb5562743f4b39ec474bae614081c583
MD5 f43f0071958a0b23d16e1f14e76e3966
SHA1 25206539aa6e782341f1124a380bd3c75d325e52
SHA512 4c44056b25f7c473c6983f4c3d5b661ff5baf59283a42d4266ce9295d93b5636a5b3eea3f04fe17b7b2d1e3f6d01d87a78b9c20cf684613e1e5d95d88c5c7b38
SSDEEP 384:NZcIt8NdzDWuX3RxzmYxgX532N8md+SX5desswBOObjI9G6w7iS:Vt3g3zOSX5gSB29MiS
TLSH
T117927D32AC78AC77A9A3D551B48A36134FF8502BD7C86F84E1EDAB0C059BADC5319C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b35e8ce2845f22fc27b212272f8bc331f1015dff6f42efd5bfacdc49392bcacd
MD5 4128495cbd560896d8e88583e7ff7455
SHA1 d5cc43411ceedcbd4e93623e7ef31113e51a1c8a
SHA512 0d3b3baccfb871dee3919805f0cf3730a048958ccb3b55b7f8d54f1235ff96b555cd405ee92fc7ce326aa0b8041dd18fb1da4997b52106170811fb9c4d0c4675
SSDEEP 384:uJZcIt8NdfDWuX3RxzmYxgX532N8md+SX5desswBOObjI9G6w7iS:utXg3zOSX5gSB29MiS
TLSH
T111927E32AC78AC77A9A3D551B48A36134FF8502BD7C85F84E2FDAB0C059BADC5319C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aeaaeab64211312892fa4679b6172e80371abae718df786a4ebca5db074c3613
MD5 7d1e8500de2136a724c56a952216d467
SHA1 2fc4f24be017d36fa20f63a484290232c295a8f0
SHA512 aaaaf2f5939ab65297aacf90806bc4de475055f2bc8a12e6994267720a82966d2587afd8c2930c5b5c6eaa7726d488fb65c3a1450fcd91bdb1502d54d9fcb422
SSDEEP 192:6GNz6i5fQmiUy3dFO7X5zPr2xjzormDZ+RajmfXU6:6GNz62hQ/O7X532N8md+uoXU6
TLSH
T13702D835A9646C779EF3AE45B58737135FE5102BDA946B80DAEC1B1C008778C1316C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a33b1b12-792f-492b-8b28-fc5bff03159d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a33b1b12-792f-492b-8b28-fc5bff03159d.tmp
Size 8KB
SHA256 bbbadff02e18970007e751bdb8fc60d4a22d7bda20939605dbcf888fa3c22c65
MD5 fb751674367caa6ad2d6d68b657970db
SHA1 6f457802fc1ed996609bfb3b8d2c6fc71a0a6bc2
SHA512 94fb057a75fd075e724b833747efcc33a80cfd3c063c0330b79c4291c63930945a2d23b20b25c975a96b3757998261215702fe03a296abcaf660f732f89ce090
SSDEEP 192:5GNxS6i53QmiUyvMFD7X5zPr2xjzormDZ+SX5gYresMGQAqzU6:5GNo62ZyeD7X532N8md+SX5desWBU6
TLSH
T1ED120A36A868AC775EE3E595B08731135FA50127DA886F80D6FC2B1C01DFA9C535DC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads