hxxps://blackbaud-privacy[.]my[.]onetrust[.]com/privacyaccess/eyJhbGciOiJSUzUxMiJ9[.]LzcyODM4ZTI4LWU4ZTItNGMxYi1hODkwLTU4ODExMWQxOWQ4OC9wb3J0YWxBY2Nlc3MvYTA3NmQzMWQtYzFjMC00NTc4LTliNmMtNWY1NGJlNWQ5NTMwL2VuLXVz[.]g_5qwhlYCH9l_APiqKvfDRzIABuA1ZEmW_ytWMe5u8VRscjTQKquttq9VkY-nL5epOxQCfuaOs0Tqt_FvIiDz2vAjzkpd7cm9tioxtsvRs53IRsw_HdyKbBntzyebu-td0S5b1Iu0SFNiXLqe_-dpRTZs5RWw-qhf3GhB8r1hQL-Xg2TXlCjzhwy6CtKuAbJzVCdOzTLeO5P0NcnjUSSPYkTzyPHsiD3pFO

Analysis

user interaction
yes
max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://blackbaud-privacy.my.onetrust.com/privacyaccess/eyJhbGciOiJSUzUxMiJ9.LzcyODM4ZTI4LWU4ZTItNGMxYi1hODkwLTU4ODExMWQxOWQ4OC9wb3J0YWxBY2Nlc3MvYTA3NmQzMWQtYzFjMC00NTc4LTliNmMtNWY1NGJlNWQ5NTMwL2VuLXVz.g_5qwhlYCH9l_APiqKvfDRzIABuA1ZEmW_ytWMe5u8VRscjTQKquttq9VkY-nL5epOxQCfuaOs0Tqt_FvIiDz2vAjzkpd7cm9tioxtsvRs53IRsw_HdyKbBntzyebu-td0S5b1Iu0SFNiXLqe_-dpRTZs5RWw-qhf3GhB8r1hQL-Xg2TXlCjzhwy6CtKuAbJzVCdOzTLeO5P0NcnjUSSPYkTzyPHsiD3pFO
Sample260804-rnc2rssenh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4124	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303268126647064"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{4FC64A09-4322-4791-A539-777F1AB9F462}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 936	4372	msedge.exe	87
PID 4372 wrote to memory of 4124	4372	msedge.exe	88
PID 4372 wrote to memory of 4236	4372	msedge.exe	89
PID 4372 wrote to memory of 4236	4372	msedge.exe	89
PID 4372 wrote to memory of 1700	4372	msedge.exe	90
PID 4372 wrote to memory of 1700	4372	msedge.exe	90
PID 4372 wrote to memory of 1700	4372	msedge.exe	90
PID 4372 wrote to memory of 2220	4372	msedge.exe	92
PID 4372 wrote to memory of 3800	4372	msedge.exe	93
PID 4372 wrote to memory of 2220	4372	msedge.exe	92
PID 4372 wrote to memory of 2220	4372	msedge.exe	92
PID 4372 wrote to memory of 3800	4372	msedge.exe	93
PID 4372 wrote to memory of 3800	4372	msedge.exe	93
PID 4372 wrote to memory of 548	4372	msedge.exe	94
PID 4372 wrote to memory of 2656	4372	msedge.exe	95
PID 4372 wrote to memory of 548	4372	msedge.exe	94
PID 4372 wrote to memory of 548	4372	msedge.exe	94
PID 4372 wrote to memory of 2656	4372	msedge.exe	95
PID 4372 wrote to memory of 2656	4372	msedge.exe	95
PID 4372 wrote to memory of 4644	4372	msedge.exe	98
PID 4372 wrote to memory of 4644	4372	msedge.exe	98
PID 4372 wrote to memory of 4644	4372	msedge.exe	98
PID 4372 wrote to memory of 1624	4372	msedge.exe	100
PID 4372 wrote to memory of 1624	4372	msedge.exe	100
PID 4372 wrote to memory of 4724	4372	msedge.exe	101
PID 4372 wrote to memory of 4724	4372	msedge.exe	101
PID 4372 wrote to memory of 2064	4372	msedge.exe	103
PID 4372 wrote to memory of 1264	4372	msedge.exe	110
PID 4372 wrote to memory of 3884	4372	msedge.exe	111
PID 4372 wrote to memory of 3844	4372	msedge.exe	112
PID 4372 wrote to memory of 2500	4372	msedge.exe	116
PID 4372 wrote to memory of 2500	4372	msedge.exe	116
PID 4372 wrote to memory of 1836	4372	msedge.exe	117
PID 4372 wrote to memory of 1836	4372	msedge.exe	117
PID 4372 wrote to memory of 4712	4372	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://blackbaud-privacy.my.onetrust.com/privacyaccess/eyJhbGciOiJSUzUxMiJ9.LzcyODM4ZTI4LWU4ZTItNGMxYi1hODkwLTU4ODExMWQxOWQ4OC9wb3J0YWxBY2Nlc3MvYTA3NmQzMWQtYzFjMC00NTc4LTliNmMtNWY1NGJlNWQ5NTMwL2VuLXVz.g_5qwhlYCH9l_APiqKvfDRzIABuA1ZEmW_ytWMe5u8VRscjTQKquttq9VkY-nL5epOxQCfuaOs0Tqt_FvIiDz2vAjzkpd7cm9tioxtsvRs53IRsw_HdyKbBntzyebu-td0S5b1Iu0SFNiXLqe_-dpRTZs5RWw-qhf3GhB8r1hQL-Xg2TXlCjzhwy6CtKuAbJzVCdOzTLeO5P0NcnjUSSPYkTzyPHsiD3pFO
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffaf729c188,0x7ffaf729c194,0x7ffaf729c1a0
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,3858108442826094501,15251090567996067072,524288 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,3590812594487485409,9514584913192570403,524288 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,7482970911419639717,678022475951326695,262144 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,14955827943268412098,16951533548241583429,2097152 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,5204660660700900274,14908913270823501546,2097152 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,2452105802634300844,5639690428248652191,2097152 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,157182164131530639,18342910427863314110,2097152 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5032,i,11833700174427034739,11024790379334505546,2097152 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,17716245877115452258,15883571454136728473,524288 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,5966170311380097931,10640770114165179351,524288 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,6849632869936048454,5674426784453512386,524288 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,6849632869936048454,5674426784453512386,524288 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,6600903700726674220,14961770994824102688,524288 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,8986876138305463735,10847634761696363791,524288 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,15466796517891863725,16062064371300422534,524288 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,9672289588265704889,3742950705666746663,524288 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,12458710964998283827,13569244613432761894,524288 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,3953655142234404865,17148700611706610543,262144 --field-trial-handle=2380,i,14793824059642592034,1484009230788253163,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 19770e7fe2094711e80964a836e60964de6a8ad16ccaac3d8dfad98369019638
MD5 44dad74e010b183434bee387e897e5a5
SHA1 1e8cd1a25c1805f95db825d1abc631a4dc4b3528
SHA512 4bbc70e7b7329e93d20b196e728888ea0151b121d95738e26f908478d84bd38ac8410bda7f62d907ab7d1206a6ca2df9c6c71f59ce1ad6ea772dbae5c26236d5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3855e927825caa9aa6254f6a0ada6976c45508e196c717bd475f292560d780eb
MD5 c5af0bd04cfeae5d8fbf0438f030bbe1
SHA1 f6759d4a91dc4f0408cac93ab7def6a88148887b
SHA512 31bef0acc2c994f4a9401b929245e3b2dffc7538bb94ab3d77c10a17b4ddb63e298d06054b553f72dcc7f185da37c985270475e1732e86442be254181dae2241
TLSH
T13B712ADD3322D492D3600E30F7DF0293B9F241880A8F6D52F208597D6A0AB6F426B538
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c9f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c9f2.TMP
Size 3KB
SHA256 a9678fd59552cd0b0a8a6f1871a15f8921c0da52c8588c59140c3a7f52872e47
MD5 017556d631101a2af1bc5c1310f5ecb6
SHA1 32705f37253e542816441de92c077764d1a1d1d0
SHA512 a9a92dbdfe34f2d3f7c2ff38d18255d2c43b8f9b0f7bac3982db6becdde11a4ea315a6a6029fa93bdb6a6a2fddbbebf0d7600e1c6bad0cf86320ea7575de8a1a
TLSH
T1B3712BDD3722D452D3200E30F7EF0693B9F141880A8F6D56F208597D690976F427B638
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1f209563f3fa9ef66394eedf65757ed93b2b96b089ef952d986167118d54e8a5
MD5 319b2226c51cec918aee8985e13d1d2f
SHA1 b1e43efdad8a4adc54fa3d5acb1eb3de4c20062a
SHA512 fefecff96ab909aa4a68c5b7f971913df09043041d626f3868f938e3912fa364c7bbcb75c13b9a70941dad65b180f7bd788d175daedaaf47c62a85069bb351e2
TLSH
T1A9118BB3C7E4966E8D1156F05A24AE1BCE2C0A01432C7C6985D4EF2793E3465E00195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f1fbc98a76f7a4652a25dc1f867b9da1482d33e1fc03890a0cae9d57f5683b92
MD5 18280a96896fb78096dd11a9678c3e11
SHA1 0af81f0869b34fe1387554b3b338e87f6bfb73c3
SHA512 7d695d9408f0197d8b89c53d6fde11fb5ad45c14d7480b482fca1bf9cb159678facff97816eb086c2fae010a0a7c3b592bd5747004342fc23d80c3f0342decf5
SSDEEP 192:sxZCR4yM/jK1Ml8MkT/fPsMSC8rIdpqAHW6+WNGYwKnNGIgrJ:sxZCyMT/fPsMSC80bHbGD9
TLSH
T1FE4208116A34A97BCCCBD209FA55BF43D6F55572A2940E44A9FCDA0C04E6AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6cdf572095ce80816adaa0ed4eb7b0081e0730b5e1fe5678b75b112053048e89
MD5 cb755c0822e08e0e6fa9f82bc1c574a6
SHA1 75b7b11ceb32affbba4391ca50c49abc7096b522
SHA512 814f880d1b1ec4e9ccc7b4226dcd6613f652c29d63cbaa1be703d6ad7fae265c57eee0e8432eb68f3be5616fec050f37b5cbcd15c1a339bf6b14b78fbc4862b4
SSDEEP 192:sxZCR4yM/jK1Ml8UQ7kT/fPsRSO8rIdpIAHW6+WNGYw78YMGIg5DSJ:sxZCyqQT/fPsRSO80dHbGV5u
TLSH
T1D0520811AA38A977CCCBD209FA41BF43D6F55473A2940E44A9FCDA1C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9c97883ebf25c7885006445a848669b5f2b7b35b697f224e7817afe40e702c75
MD5 6660e0d7581ff391aec487a3b95ed811
SHA1 4f651fbf4cd4fa26943c0786ea7b84cfb60d15b2
SHA512 f10c4db34e5fdceb64afe72592236ea046f2eb3c42eac84a4300469929af37e78a5491a12cf5408df833b727fcdfcd6bbf0768df1bcc499608aeb417f07fe259
SSDEEP 768:M94jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dnrohKc0aD:M94jeXmWvmKLEu1jacPLZQd0vT
TLSH
T1F9D2093B284CCB7E4F844E5CEC26AF976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9620e8140dd7ce7785eff33604a86a199ca058d19d2772c7f3b7a62e945815be
MD5 b2aee7d216eddfb5efa7cf9599acedcd
SHA1 fde0e91fdc2751bac02cc67414ffa930c3009881
SHA512 fec4f14b5ef00a6c5839c15596deca6ea8f02d90dd7f679aced2b8cb84100089055e7c584217e6c441fb16fd22d1ff8fa674fb25f1dc7ac04727aa387054f397
SSDEEP 48:K0CFI9K+IgXyp6IfKP6A0xkXLxnHxCrysIhTxK04cRxwZhP7:K0CF6K+Iq66UKP6oS4KD6G
TLSH
T18091405270BB52813C3E281CA654871A4B5271A33518B86BBFA840771E77F685CFE8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

633518bc-579f-41e4-bd6e-3cb1ed09b334.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\633518bc-579f-41e4-bd6e-3cb1ed09b334.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e8f61158d507d2454166da2530b822ba964a86e21f90354d9e79663b4547b701
MD5 5d6dcd01675c4025e83b005a642020e4
SHA1 cb81c0cc3429aff77ecef784d98573f59206daa3
SHA512 78a51df9a0b851baf8233cc8872bc348c9665c47048b4ab97420463f68128dcea059a2712d8c41fa4ab7549bc46d0238cfec55916497a96af0e9eaf228ffe07b
SSDEEP 384:csNRnX6cNf+G8WYWXRF6IBeRs9JKgqijUAUQh:cGtxr6ITjKgqmUc
TLSH
T148725B35A868AD779DE2B681F04B32134FF4501BDED47FD4E6EC6F1D008A69C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0d231904e5085e9788422b56594906023939a995da2dcf6ace0a7dba6113ad9a
MD5 61d50076d87701aebd299257b3558a47
SHA1 9ec0c98e670bb826f99178d51b3db37f0e1764ad
SHA512 8c09eccecb42791f5631c406d2217025607c1dc05afd1328c3f6e7538a2abee78ea89b3d00c15f5822e2623dd630df75dc441b98fa1d88ef9c1fdd589804f0e5
SSDEEP 384:lZcIhsNRVX6cNf+G8WYWXRF6IBeRs9JKgqijUAUQl:dhmtxr6ITjKgqmUq
TLSH
T18E928D315C78AD7799F2B941F48B36134FF89027EAD46FD4E6EC6F1D008A99C130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 f60ffc1b885a4adc4910c16da614ae0f69393a025d8be99af5a421f937e85d3c
MD5 79cc212c25848bd0850b4c41b1b75a49
SHA1 b43d2d9444d0e2d3a01c90315642bb4f89911df0
SHA512 4eb687aacec825d2a7eef3efed420e5aaa50927dd1f16f1ff684a0cab5acccab3a124532cd3eeeef4325a2c9e4ebd3cac1400682a75a7bf7cdca66f985fb0f58
SSDEEP 384:3iFiZcIuzsNj8TUNTUlIl2X6cNf+G8WYWXNF6IBeRs9JKgqijUAUQl:yFQumwgItxn6ITjKgqmUq
TLSH
T1DCA26D324C68D97BEDF6AE81F44A32138FF55067DAD0ABD4E6DC6F1D004659C130AD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ffed1344575b4126f72218ca425e6c223da36a343580d6c13042c1c775a59f4c
MD5 8350d99c6bfe2320d48babb9a496f870
SHA1 d13ba0819699c5cc18433321b4ee3ef66536bd66
SHA512 7ace1a6da1d09dd900750385a00cad459171bbdecc5c377cb78d6c3bb84eab4726b26be32e87c64d5292f5018062186df26eff03e740bbfac4992d3a19845e70
SSDEEP 192:EONC6hZ0QmiUy9Npc/+jV0jzorWYt5wOZ2iU6:EONC6ocpu+G8WYc2dU6
TLSH
T1E002E935AC686C7B8EE2AE45F48737235FE5112BAD956F84DAEC1B1D00C779C2346832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9045ac8c95fe5c038bd1c9fa7d1c0e725c0f811b291c9a04577ecc41604aff47
MD5 7a75f0f558b7067b673a4747a2173b30
SHA1 ca03ed3593b14ad3f3b4899492811a85af4284cf
SHA512 7ae486f185fe7b46d7b649708894f65834e9bfaa0fd407e60af72dbae9875d2dcb3f3d8b8a480f9f7c7410ce74d554e1a2f9bb41d010d0e7eb1b13b07c3dd575
SSDEEP 384:pZcIhsNR2X6cNf+G8WYWXRF6IBeRs9JKgqijUAUQl:hhvtxr6ITjKgqmUq
TLSH
T1DA928D315C38AD7799F2B941F48A36134FF89027EAD46FD4E6EC6F1D008A99C130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e06d30b1a68fe53682e799fd15da03ad9823b534c369a39add93d7ce751d02e3
MD5 2699e5c1e6645853e8dd9f85dadfa7e7
SHA1 d3d1685919bad9e69622482a4d8aed1e087316a6
SHA512 8284d7b530722fdfceffdbf34c866869c8007d45c40dbee6249bec5e182c4e4a6738a09fa82b7a6417950297b8055119690d8783b9709b6c9e707a418b117bac
SSDEEP 192:PON86hZqQmiUybNPc/+jV0jzorWYWXC5cOqBqHIU6:PON86icPu+G8WYWXt96IU6
TLSH
T1F112FA36A868AC6B5DD2B541F48736134EE5511BEED57FC4D6EC2B1C00DF6AC234A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

639d5f4b-1865-4da4-800d-412037185e67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\639d5f4b-1865-4da4-800d-412037185e67.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8fe62979175839a735b1ef4f627d1810a7fcb1d4ccc729b1c8aca6c8ea86bc52
MD5 f3cf04c4dba6f48e88a57c46b553c821
SHA1 e3593236e115072ddb28bf8c4b774bd7207024b1
SHA512 c98f79f9cea08764ddff8407fb16fb5a3df8254a924f4112aeb42d14ea5d6ed5dc8c04d6f28bc1d0bb70ec11a3966c6bac3e01954eca3fef599cb373861e0334
TLSH
T18D411A58A6FA2148B3B76F56AFF6A46C457EBC762E06D45D00010D4F0A33A40C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download