hxxps://e[.]customeriomail[.]com/e/c/eyJlbWFpbF9pZCI6ImRnU1d4UTBEQVBKUDhVOEJuLWpCTDdiOEF6LTdQcWk5bGg3eiIsImhyZWYiOiJodHRwczovL3RhbGx5LnNvL3IvZFdvQmRWP3V0bV9zb3VyY2U9Y3VzdG9tZXJpb1x1MDAyNnV0bV9tZWRpdW09ZW1haWxcdTAwMjZ1dG1fY2FtcGFpZ249cHJvbW90aW9uXHUwMDI2dXRtX2NvbnRlbnQ9aGVhdC1pbGxuZXNzLXByZXZlbnRpb24ta2l0IiwiaW50ZXJuYWwiOiI5NmM1MGQwMGYxNGZmMjRmIiwibGlua19pZCI6NjA4fQ/229422abdb50639dc82cb83e6bf924667044b38724b9f28a169884e8b545e763

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://e.customeriomail.com/e/c/eyJlbWFpbF9pZCI6ImRnU1d4UTBEQVBKUDhVOEJuLWpCTDdiOEF6LTdQcWk5bGg3eiIsImhyZWYiOiJodHRwczovL3RhbGx5LnNvL3IvZFdvQmRWP3V0bV9zb3VyY2U9Y3VzdG9tZXJpb1x1MDAyNnV0bV9tZWRpdW09ZW1haWxcdTAwMjZ1dG1fY2FtcGFpZ249cHJvbW90aW9uXHUwMDI2dXRtX2NvbnRlbnQ9aGVhdC1pbGxuZXNzLXByZXZlbnRpb24ta2l0IiwiaW50ZXJuYWwiOiI5NmM1MGQwMGYxNGZmMjRmIiwibGlua19pZCI6NjA4fQ/229422abdb50639dc82cb83e6bf924667044b38724b9f28a169884e8b545e763
Sample260810-bbjqsagm4x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4848	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307971033793251"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{E7AC96F4-A768-4A5A-80C0-01883EE18AD7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4368	4320	msedge.exe	83
PID 4320 wrote to memory of 1724	4320	msedge.exe	84
PID 4320 wrote to memory of 4848	4320	msedge.exe	85
PID 4320 wrote to memory of 1724	4320	msedge.exe	84
PID 4320 wrote to memory of 1724	4320	msedge.exe	84
PID 4320 wrote to memory of 1508	4320	msedge.exe	86
PID 4320 wrote to memory of 1508	4320	msedge.exe	86
PID 4320 wrote to memory of 3976	4320	msedge.exe	88
PID 4320 wrote to memory of 3976	4320	msedge.exe	88
PID 4320 wrote to memory of 3976	4320	msedge.exe	88
PID 4320 wrote to memory of 1812	4320	msedge.exe	89
PID 4320 wrote to memory of 1812	4320	msedge.exe	89
PID 4320 wrote to memory of 1812	4320	msedge.exe	89
PID 4320 wrote to memory of 3860	4320	msedge.exe	90
PID 4320 wrote to memory of 2800	4320	msedge.exe	91
PID 4320 wrote to memory of 3860	4320	msedge.exe	90
PID 4320 wrote to memory of 3860	4320	msedge.exe	90
PID 4320 wrote to memory of 2800	4320	msedge.exe	91
PID 4320 wrote to memory of 2800	4320	msedge.exe	91
PID 4320 wrote to memory of 1344	4320	msedge.exe	95
PID 4320 wrote to memory of 1344	4320	msedge.exe	95
PID 4320 wrote to memory of 1344	4320	msedge.exe	95
PID 4320 wrote to memory of 4424	4320	msedge.exe	96
PID 4320 wrote to memory of 4424	4320	msedge.exe	96
PID 4320 wrote to memory of 1448	4320	msedge.exe	97
PID 4320 wrote to memory of 1448	4320	msedge.exe	97
PID 4320 wrote to memory of 748	4320	msedge.exe	99
PID 4320 wrote to memory of 4576	4320	msedge.exe	103
PID 4320 wrote to memory of 3784	4320	msedge.exe	104
PID 4320 wrote to memory of 4652	4320	msedge.exe	105
PID 4320 wrote to memory of 220	4320	msedge.exe	113
PID 4320 wrote to memory of 220	4320	msedge.exe	113
PID 4320 wrote to memory of 1108	4320	msedge.exe	115
PID 4320 wrote to memory of 1108	4320	msedge.exe	115
PID 4320 wrote to memory of 1764	4320	msedge.exe	116
PID 4320 wrote to memory of 1764	4320	msedge.exe	116
PID 4320 wrote to memory of 3912	4320	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://e.customeriomail.com/e/c/eyJlbWFpbF9pZCI6ImRnU1d4UTBEQVBKUDhVOEJuLWpCTDdiOEF6LTdQcWk5bGg3eiIsImhyZWYiOiJodHRwczovL3RhbGx5LnNvL3IvZFdvQmRWP3V0bV9zb3VyY2U9Y3VzdG9tZXJpb1x1MDAyNnV0bV9tZWRpdW09ZW1haWxcdTAwMjZ1dG1fY2FtcGFpZ249cHJvbW90aW9uXHUwMDI2dXRtX2NvbnRlbnQ9aGVhdC1pbGxuZXNzLXByZXZlbnRpb24ta2l0IiwiaW50ZXJuYWwiOiI5NmM1MGQwMGYxNGZmMjRmIiwibGlua19pZCI6NjA4fQ/229422abdb50639dc82cb83e6bf924667044b38724b9f28a169884e8b545e763
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe8275c188,0x7ffe8275c194,0x7ffe8275c1a0
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,1443752709558227027,9545843086377302184,262144 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,14376886003337641716,18017306261861135260,524288 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,7312487318439594409,10905275475050458033,524288 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,3389670414106262872,329809753721328807,2097152 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,12338247566164938501,16700315251327889994,2097152 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1728,i,9825221441725726164,2436336402094364360,2097152 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,2870146042686766463,13443056050095190267,2097152 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5156,i,7397608294062845052,5872237472894266700,2097152 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,13892396880321273600,2649641886682891607,524288 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,6752055143191233062,5945241638538833752,524288 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,17789511843786925876,5830596496557839955,524288 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,17789511843786925876,5830596496557839955,524288 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,18421650976117571108,13818450639469026172,524288 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,7488410847441139530,12373966299130332901,524288 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,7667030181913492330,9299514436581170502,524288 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,12431730867652305139,4076298881691630989,524288 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,8701553301963748805,2660991317690628816,524288 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,2469337946224761463,12917465834620373510,524288 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3700,i,11216336619755931764,12198980670719231647,262144 --field-trial-handle=2256,i,5977204467099235183,18385424854768421453,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

9a87eef4-4973-44b6-aa12-df409533c762.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a87eef4-4973-44b6-aa12-df409533c762.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 dcf307c656ba2e452091efb68e1eeb811bc176b08974318f9b44e0efa5e0fd29
MD5 66209702b9f6c758f77b3763bba78928
SHA1 8f752fb5823f102a6ccb3d7a5a926fc6f097d9bf
SHA512 026b986de2376e9b8601329a02051686bf78737874e4f8bb1f339ccc5b15419cf47f54a403234a127b7682c4d3f31d1eddb48695b9d3b906e7b1d133d47bf70b
TLSH
T12AE0C0A003CFC61DFB407D430268A34CC3D0328FC2C8F946170484DC3041850E6975E0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 367f35f5cff60a3dff968f4b10174915744e8080cc3c67d34cb93190c06b619c
MD5 c18175a5ca746d17058acce4d8c103d6
SHA1 c60b8f117b3cbc17fe8bdb570bcd10072d09a80d
SHA512 1d09e6c47d9cc8daf0c9373f8594ee87059174029531412f91141c526f497c0d1d8482fd37efb421bfac534aea4535b783e7bf15fe811264210788d2015ee9c0
TLSH
T14B81B8B8959F9369F78A52F06BD20094303244DFFD032F39232AACBA195634B61CCF46
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 53632f452bea98a29fa19802cc32594c36ed696c68a09ca5699176e85532c7e9
MD5 534cc9d18212f640664e2e9a3796f768
SHA1 20f396cce151a90e4debcba50265e1ae470ae144
SHA512 941f6ded21a54c4e2135a6fa9668931d34dac60afced0f16ec65f0a5f5469e8f8f802a3049ccad61c177a409890db2e0fe41215b159c97513e0fe540b6dc3498
TLSH
T13C4156F383F4866E8A1152F4AA186E1BCE5C0506832C7C56C6D4BF2797E28B1E251A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3e2f09b312e38bb8707bc1ea0eff24faef18a18bc4f0fe4a3d90e8b3f93453e1
MD5 eb572ce5e09d580429a484ebe8a5946b
SHA1 bb354bba40e03afd7894ecff470c30bfb4d647d6
SHA512 92cee269421e38190b8e9873071065915f49048589a1e4d178d616cb411c073fc4628367ebad1169aa9278e2e39871617ffaf3340c7fede4c9b5810383d80ef6
SSDEEP 192:sxZYR6kD/fxsjCgtbIdpXldHW6+WN6Tr/YIjAi+gIgrJ:sxZYXD/fxsjCgOXHbm/xD9
TLSH
T15F22B8126E28A97B8CC7D21DBA19BF53E6F9543291D11E58E6FC9A1C04E77CD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c54fd3bd4b4fe76698a1ffb73d35f99ed86632ab14eb3daa4c7e34dabf7f4241
MD5 18b9fa4907e8b61b5b71c84cbb60cdf9
SHA1 a65129423c714ad816be4e17459bf84670a1644b
SHA512 064e2cc2fb934de30d9079b1ace2661038a11488a302bf8f916b1f633c9a6f0446d2d3ce8815c79de69f26df3dd826ed9438af55293b9c274bbfaaa20e5c39d7
SSDEEP 192:sxZYR6kD/fxsnCgtbIdpXldHW6+WN6Tr/YIjAi+gIg5sJ:sxZYXD/fxsnCgOXHbm/xDy
TLSH
T17E32B7126E38A97B8CC7D21DBB15BF53E6F9543291911E58A6FC9A1C04E77CD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a276fa921622ec72b062003dfb85ba2977527fbe6668d0567fe855ee084af6a8
MD5 55616c12766255f912e567f5b9a431ba
SHA1 38c287fdb264344d12735eb19e7917fafb18b10c
SHA512 4ad79986b6c27f8d89bf0a6cda115e9ddc6a0295ff80523f0a3494c40655cd5918bbb47a39923a3a8280f18446071165f186c86c00dac7498bfa404c9825d059
SSDEEP 192:sxZYR6kD/fxsnCxtbIdpXldHW6+WN6f1XYIqAi+gIg5V8cJ:sxZYXD/fxsnCxOXHbkX+Dzh
TLSH
T14832C8126E38A97B8CC7D21DBA15BF53E6F9503291911E58E6FC9A1C05E7BCD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 41413078f4b41c5074525edb8cd97de28867f8aed539c719ff1e8edc4508f6f0
MD5 90498f469293c6d2c195e6bec044d6e7
SHA1 2840ca1172ab329f84b552279b4957e0b7883bdc
SHA512 b657487bb3e6e6ff9ed0e66f3b3dee74f182ada43f3e84a70b88040de0eeeed6927aee54501592a49c8d99d98dab60a4cf432fa90bf6723e07dc0c1d752d1caf
SSDEEP 768:U3yqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7Provyb8:U3yqbblWvJDjTu1jah4LAs7cvb
TLSH
T19EC2F93B654CCB7E4FC00A9DDD1A6FD73E9802C7A6588D4047FA994C02CB7EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c8362131d89a1f6a9c595e4373c265f35b28c03139087413430a4c47f4965544
MD5 452d98ec94391092611fc6b8bbe5acc0
SHA1 86c97c35da02a290344785b7ef642d810ed4de81
SHA512 741abb4d2c58337f991316f4795e40fab21c688ff1eb309eee7decc979068a7fbd81886f317bcb3674d2671142bba5b64c113738ed3ba0427c29651bf0d742a5
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyskHQE6SC2cS99IrE2KKTCm22smNFWkt:KYbaKYIKmdCK+wSOneK8Uu
TLSH
T1BA91F10A723A0283393E2958B26686774F4532633459A5AF3FB954714DABE234CFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3e913a34581b017165fab6785ef85aa16370ac410f7709ded83c4db80fbbe735
MD5 66b743acd6bfb7a897ebdd5e7f3a9029
SHA1 c62d8a59f8dad3130a235441837134077dbe3e8d
SHA512 8c80784a6c45dabd451ce8828a29e4b2b168e8b40be4a04c81003da2d525fe4ef7372c2d4f34609e751acced3a6e2e2c7f5b8e410608bf08ddbc71d9a4b9d8e4
SSDEEP 384:TZcIhsN1URLmMbs7SVRNuOPxQ9eUxb76HlytEDq15CUd8:LhP0gHuOS9eUx/oy6DqXi
TLSH
T103928D3169782C375AFB6445F88B3A175EF89027A7C46F8491ECAF2D01DF5A8130F929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7111eaa9ab33ea7b1afd9e59b11f8095f97f7b672f331338ed8e9b5b3b887e46
MD5 6abba76cba95854712c7a9a23b74272b
SHA1 fbc60768854d301e2e76888b844cd8c9099cd755
SHA512 41ee4f06458f956455eab94f29feb1b671bf5ae5acafa6b795b6e5dcfe7d00bd7f5a6ef3c41aad09eadaba179948bcc08aa6761815fd700e141140efbd2cb137
SSDEEP 384:ZZcIhsN1UYLmMbs7SVRNuOPxQ9eUxb76HlytEDq15CUd8:xhQ0gHuOS9eUx/oy6DqXi
TLSH
T123928D3169782C375AFB6445F88B3A175EF89027A7C86F8491EC9F1D01DF5A8130F929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 564cfa6a979547e3f0d27182d0d0b2501aa1a94772b7240aad070c2407ed2223
MD5 576633456265bedcfbc54f4f4bdd85d2
SHA1 462f9c5efbbef72506f870921ee76c54607e4cc6
SHA512 d2851a234a8d199455ffd0b7a12c3fb02dab51a20dcb1f60368fc61e6349d06621fe7daf7fd3f99154f29d7e376f6ffad372b2307b091a7e3354a282be8168b7
SSDEEP 384:9ZcIrzsN1UYLmMbsySVRNuOPxQ9efxb76HlytEDq15CUd8:l/Q9gHuOS9efx/oy6DqXi
TLSH
T107C218F159E71832C9AE6747A7BE2D135EBCC027B6841A80B3D85B1DCD8A17FD30A415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f3e775511bf31f6ff1e0b5b1dd35d315c541bcfa693e029edeeaf80ae8db66e7
MD5 23a53a1c3bce9f001d18d0f74522d78f
SHA1 ec13dc303b2bc70d97847a3ef702fa2b364fcf79
SHA512 3b27b6132ee57fee186dd13001ac8618568b78851286b9a6d54de7a1ba02e5666ad433ff242eb3ae490e261de5e3e72869fcf58f8b45c7abd10df6a56429cdfc
SSDEEP 192:tONW6JkRtQmiUy2qW+RNuOmYxBh3xPRTU6:tONW6UrYW+RNuOPxbxlU6
TLSH
T14202D7357D382C7B8EF26E49B98B27135FA5207BF9956F80DAE81F0C01D765C2306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 512ec49addfb28f8676b78091db50d59275ec914b56d4f7070ff6c7c1a8f2ca5
MD5 3b86e0d129dd04d03ae995fbac21e3b3
SHA1 235a2a04090387ae481271fe5023da97df3ad5cf
SHA512 17014c2bebe4c695b1776a5e780e442b3f15cf4b81e57070e884d94e4734bcb10a4c86bf914e0a167a37e46192af519774b36b535bf48b7561f148cd9506dc80
SSDEEP 192:NONv6JkRDQmiUycqO+RNuOmYx2j9eHVcxFquocU6:NONv6U18O+RNuOPxQ9eWxb7U6
TLSH
T15512093679386C774EE26844F48736175EA9512BEA897F80D5DC1F0C02EFA9C130F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a94406be-53b9-41d6-9f39-56e7c6392a38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a94406be-53b9-41d6-9f39-56e7c6392a38.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 51b44e118e8b86b765a7984735c6e1eaba0696aac1e7ebcf760a265187ca38b3
MD5 11c0b09df74f78afb5cfc587141784ae
SHA1 33d2e2b01fb92ebe8479b9a260275b8385eab97e
SHA512 00e96173b743461dda7d24698d5fec2cc62c1c282a37dd7ef3bed511c50832ad526c795bff946b94b4008f6918b1c781df1c0d1fd5ef598c0682ffbc52c23c22
TLSH
T16E41C85CABE91158B7B77E5A9BF7A86D447BB9372E46846D00010D8F0A32B41C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download