hxxps://u6124295[.]ct[.]sendgrid[.]net/wf/open?upn=u001[.]WuTz9aHrbCrziim-2Frk3TSIMmSjjxITbduyn80PFM2p9vmWLejvBTv0rj2-2Fne6S4F5NXL14-2F87SAMjFdqULllD3oGAAmRIPHKGH4VYD0du2agHFPIx9DwZPllAxjZAEOEVo6gTjAh2gJNMo9k9EwCYVUfUtgsWeoAhfWD9raulFQNa38I-2FrTaFwdyAyjdla-2BIJ2bZ34VX-2BYjEd-2Bi0sOry7H-2BFNt0GlG4Lb24tF0K-2FFr0-3D

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://u6124295.ct.sendgrid.net/wf/open?upn=u001.WuTz9aHrbCrziim-2Frk3TSIMmSjjxITbduyn80PFM2p9vmWLejvBTv0rj2-2Fne6S4F5NXL14-2F87SAMjFdqULllD3oGAAmRIPHKGH4VYD0du2agHFPIx9DwZPllAxjZAEOEVo6gTjAh2gJNMo9k9EwCYVUfUtgsWeoAhfWD9raulFQNa38I-2FrTaFwdyAyjdla-2BIJ2bZ34VX-2BYjEd-2Bi0sOry7H-2BFNt0GlG4Lb24tF0K-2FFr0-3D
Sample260819-adfapsvvcs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2900	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315715430253435"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{03C7F367-DB06-4277-B58A-E1A316A8499C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3784	3004	msedge.exe	81
PID 3004 wrote to memory of 2900	3004	msedge.exe	82
PID 3004 wrote to memory of 4344	3004	msedge.exe	83
PID 3004 wrote to memory of 4344	3004	msedge.exe	83
PID 3004 wrote to memory of 4344	3004	msedge.exe	83
PID 3004 wrote to memory of 5036	3004	msedge.exe	85
PID 3004 wrote to memory of 5036	3004	msedge.exe	85
PID 3004 wrote to memory of 4960	3004	msedge.exe	86
PID 3004 wrote to memory of 4960	3004	msedge.exe	86
PID 3004 wrote to memory of 4960	3004	msedge.exe	86
PID 3004 wrote to memory of 2180	3004	msedge.exe	87
PID 3004 wrote to memory of 2180	3004	msedge.exe	87
PID 3004 wrote to memory of 2180	3004	msedge.exe	87
PID 3004 wrote to memory of 1668	3004	msedge.exe	88
PID 3004 wrote to memory of 1400	3004	msedge.exe	89
PID 3004 wrote to memory of 3508	3004	msedge.exe	90
PID 3004 wrote to memory of 3776	3004	msedge.exe	91
PID 3004 wrote to memory of 1668	3004	msedge.exe	88
PID 3004 wrote to memory of 1668	3004	msedge.exe	88
PID 3004 wrote to memory of 1400	3004	msedge.exe	89
PID 3004 wrote to memory of 1400	3004	msedge.exe	89
PID 3004 wrote to memory of 3508	3004	msedge.exe	90
PID 3004 wrote to memory of 3508	3004	msedge.exe	90
PID 3004 wrote to memory of 3776	3004	msedge.exe	91
PID 3004 wrote to memory of 3776	3004	msedge.exe	91
PID 3004 wrote to memory of 3968	3004	msedge.exe	94
PID 3004 wrote to memory of 648	3004	msedge.exe	95
PID 3004 wrote to memory of 3968	3004	msedge.exe	94
PID 3004 wrote to memory of 648	3004	msedge.exe	95
PID 3004 wrote to memory of 2056	3004	msedge.exe	97
PID 3004 wrote to memory of 3192	3004	msedge.exe	98
PID 3192 wrote to memory of 1252	3192	msedge.exe	99
PID 3004 wrote to memory of 2260	3004	msedge.exe	100
PID 3004 wrote to memory of 1076	3004	msedge.exe	101
PID 3004 wrote to memory of 672	3004	msedge.exe	102
PID 3004 wrote to memory of 932	3004	msedge.exe	103
PID 3004 wrote to memory of 932	3004	msedge.exe	103
PID 3004 wrote to memory of 2656	3004	msedge.exe	105
PID 3004 wrote to memory of 2656	3004	msedge.exe	105
PID 3004 wrote to memory of 4072	3004	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u6124295.ct.sendgrid.net/wf/open?upn=u001.WuTz9aHrbCrziim-2Frk3TSIMmSjjxITbduyn80PFM2p9vmWLejvBTv0rj2-2Fne6S4F5NXL14-2F87SAMjFdqULllD3oGAAmRIPHKGH4VYD0du2agHFPIx9DwZPllAxjZAEOEVo6gTjAh2gJNMo9k9EwCYVUfUtgsWeoAhfWD9raulFQNa38I-2FrTaFwdyAyjdla-2BIJ2bZ34VX-2BYjEd-2Bi0sOry7H-2BFNt0GlG4Lb24tF0K-2FFr0-3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x21c,0x260,0x7ffd56acc188,0x7ffd56acc194,0x7ffd56acc1a0
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,16213695246558659087,8729536924105835302,524288 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,15790316321245676296,7454519571861073927,262144 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,13514896312509701770,3557617114330118506,524288 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:13
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,4569737262286191955,10955359231433954841,2097152 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,8181641793736372548,5602054911309565108,2097152 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4012,i,2514743696499887055,8938582910001690117,2097152 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4044,i,14544814007078682517,7810096770669679764,2097152 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:9
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4120,i,9998137806830914348,14128299008906567761,2097152 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4140,i,14286042063734809537,535064132144843242,2097152 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:9
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,815483731116872219,15212953585686068004,524288 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,5854181747762694236,2819829836940142997,524288 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,17317505738930884700,3424935547792589994,524288 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,17317505738930884700,3424935547792589994,524288 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,7682157648161976865,5196050317465481333,524288 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,389698567278961526,4665419367070061192,524288 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=568 /prefetch:14
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,3905997196163078119,17276502949829320334,524288 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,11082003047616125893,18007642840477258472,524288 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3392,i,3510978315920911025,15989716643783956941,524288 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,11584795428433729983,17174403717992266469,524288 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5252,i,4698194346979861829,7587972943192809715,262144 --field-trial-handle=2532,i,6031612597950815355,10741755972925374354,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 d3d38cc8b0e28c3ddbde0f4a8f88229951233b14e6108bca1a2a5126b07d928b
MD5 a65edaec6e3805c667a764075626db28
SHA1 6d7da3e60368f0c01417985706c19ded70cec322
SHA512 65b6971e32dfbe35a3fb039948b040edec3c78a60c2cd82b432086bd24be344aa72839e4ee2f72abd606c9810ad8c8bbe7425b6242959196871c815932cea106
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7/:fwUQC5VwBIiElEd2K57P7/
TLSH
T1ABB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1241d564ef8fca53c361035c6fae96a56177d2725b93e64e5092daf8e02b6c20
MD5 608732ecd584c03be1b5bd084089fc0d
SHA1 4f0240bfe62e047496cfb42691a33bd236e816de
SHA512 34aaf99bb5d5ea5d26a2858298165a77802594b65b6d39431e7e75de8c65738dbedbc14bd48af5f44c8da9120dea9793dce2669c9a0bf44930d2071efb07831d
TLSH
T14061706A46F22053E3B31C79F3E0D114F73E64A64FA7DF7001A0B53DA916B28C5A6239
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586b19.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586b19.TMP
Size 3KB
SHA256 1befe570dc55ab4110404f9e11f7d0ada1efdbe891974c90d1b41b4936708905
MD5 9bc0baa2f5a490122dfb56a8743432b6
SHA1 7c8b6dc2a4b1cb47e6a4c3587b0b27e170685947
SHA512 9ece2b82455bc0ba2f4beeb852dac585fcfa80ca216020443bc1392540cd1a403b936d61a9669aa71680e1a270ef2bf4c41e3873d2198a4a6bb5dd14b303b10f
TLSH
T10761816A46F22053E3B31C79F3E0D115F73E64A64FA7DF700190753DA916B28C5A6239
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 50631d34a69c6d24639e3cd1fc8193c5bfdbe6fe9c294bedb33b2929a95162bc
MD5 a7f4c832107b960a190f29a5a74fcb38
SHA1 8bf37467730e2af4c90ccfd56303ee7359775b13
SHA512 de78caec963c054bba84864e0fc11bbdd2009384d7c0709396446191745c8470c0d06a41befb05e75d7705f423167a64a2b65f3bfc6b0a9862fdce481a376d24
TLSH
T107113DB3C7D595AE891116F05A28EE2BCE1D0605431C7D19C9D4FF27D3E3475D10256B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 493e32f4052b8a432fdf4980cf26ee614330ef6c35ca89bcd353a52fc55a0737
MD5 e68a8f43479f97fdacc4bd3771b5a5b3
SHA1 33e99a7f1cbe442912fbeccc04f81d5a4c35f4f8
SHA512 b08d3a811cc2899534d74c695c936f6d741c9c81aff63f1d362b4b77fc8de722b1b09aa7c50367b7a88e6a24e55e69e1798f0d5de4e8b6116004e40a17037a85
SSDEEP 192:sxZNRNyM/jK1Ml8MFK/fcsBZ9a+IAIdpM/W6+WNGY0uBHZLGk3IgrJ:sxZNNdK/fcsBZc+IBM/bG5uX9
TLSH
T16142E7126A346977CCCBD309BA55BF53D6F84472A2940E54ADFCDA1C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e82d414ca5b4b9135be0d1ba0d1246d0b50b4969ac51c2f1794588f4974a8b7c
MD5 22682b6039aaab8bac2785a33280af5e
SHA1 0cc8e5f71f5090251f0b5e04e42b522574f48e77
SHA512 c55e1ccd6103a331fb9ab230f6b63185191238e0f15d4f10243c0b09f5686300ca36c075f5333d34b9f1152344e6fafa40445b8b283a2fd85c9291e0485847e7
SSDEEP 192:sxZNRNyM/jK1Ml8UQyFK/fcs0Z9OK1IAIdpnv/W6+WNqUQ/Y0uBHXLV73Ig5dJ:sxZNvq4K/fcs0ZD1IBv/b2/5uzZ
TLSH
T19A52D816AA346A77CCDBE219B996BF53D2F4547291940E44ADFCDA1C00E2BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 10bb6fc6402c98770331be1327781c32ab4c7c5f274d233960f96893e09c11ee
MD5 7efbbc4e20633eeb42a6359384ca2ab1
SHA1 409f68176e5e38ac526b42ea1aedd78cc0df4236
SHA512 6a5933af04ab8afafe735013ae720c692690446e5bb7427d6076fc06629ebb6caaf92108efda071d3b4027fbf128ae8441c387108ae14500e0b95e58a5111dc9
SSDEEP 192:sxZNRNyM/jK1Ml8MFK/fcs0Z9OK1IAIdpNv/W6+WNqUQ/Y0uBHCLyk3Ig5dJ:sxZNvdK/fcs0ZD1IBR/b2/5umZ
TLSH
T12D52D715AA346A77CCDFE209B9567F53D6F4446292940E44AEFCCA1C00E2BDD2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 ce463dd454afd2399e7eb5bab91f688447d2b92655153b6946ebc5b64959c13f
MD5 36d38194be0988747218acebebe9547d
SHA1 2cbba9dfa79cf9be77b00f1e44fa534d56d42be3
SHA512 fbaafc0d78e9d975574eaed522d1f95a0477de1dde4643a9ccd175f802a550652e0d0a84aa4cf25c5081d68daf755905a8cc09844a481432bf344cc2481fd4ce
SSDEEP 768:qh/Lh8dF2/kWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KjLl/060loxroz1:qh/Lh8dF2/kWRmAcQ3wu1jaKKjLp0DlD
TLSH
T147E23B3B694CCB7E4F840EACEC266F976ED801CB56588D5447FA894C03C73EA411A59F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c91384982425da5440fbc55dd2ac721b6b7696311db553ac87f33928c43b0c3e
MD5 0bec7b6f513f2d4c9da2bb688aa881b5
SHA1 ab920abe1127a46b06481654d1f0f584d354354e
SHA512 a56477a4120e49db1dce0aae5055ad7c74ea36c73cb8ec0072936a34ed207d9c0ef9ae17cbf00f00584b5692e94275f02ab5ed2d76dacd73c052084ac9c95c82
SSDEEP 96:K08gKFGSqIKLiSWtWJtrL7CxDUxHdCK/nHvCT9FcHBPyKE46uPGKIwY:aU3PSR9x
TLSH
T1FDE1E497327A06123C7D290C9756873A5A4273A73098F63B7BAC10B60E67E255CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 99bd2381026f771adc4dc4e716e85cea65c43a0f7da0b6a9a0531a9e3d9295e3
MD5 508bfbd2c5068e1337eb991508021990
SHA1 1289b27b9de0cd90a7d7055d49fc9e035f0d4d1a
SHA512 13ca1f6bee23ca4c7b62d8cf21b9d8e8d945f33a598c3d1a2ec6068211644634f4ce1c4c4021bf6523ef8be4c3ef654e943d62669fcb69576435b43a3c77ab61
SSDEEP 192:uUw8NOEnaQT8gRJ940HZfQmiU1VhHl40F2oP1NmjzorPXFFXHpWeq0U8:G8NO6aAH140HPrt60FptNK8PFFXAgU8
TLSH
T12E42FA3668346C779EE3A554B0873613AFA5402B9AC86F44DAEC5B1C01DF29C531AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 4d070767951bb5a43b5f0953ef48e92974d681214ae86642fb631885fb8a145f
MD5 2d13726cd3aeedb1bab7e3ed338e5e67
SHA1 88741c4c32748317a0673efbe30190e328af1198
SHA512 54d42caffd03a1a054bec69e8153afe45698b0ff358959b868a95a6c91fbcbf045d5e22e0a14e8fc55bfbc6a37110307f9779bed3057d9b70a55a231895009c3
SSDEEP 384:48NO2AH140HPrt60FptNK8PFFXAgMsRnlYcS:4pTJRbj9FAghn2n
TLSH
T14A725C339C346C779DF7A185B0873503AEB4946B9AC46F449AEC9B1D02DF39C5306D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a52f79a3cb0c8729a730b96a47a9e0bbdfa4d6734d0068e4b63b85442ce9a2db
MD5 5c0a0681e7bc443c8f00c580c4edb794
SHA1 6b1f3e98ea342c84d366bbe4341d88f469f5cfbc
SHA512 be1600bf5ee6ddc032f8820c394ed16cc04f2f32112e7629472801f80a6c28353d48c92562d3a4c35fec08547e39ea13054fe283ba9e50e1fbac5bc2c2124c27
SSDEEP 384:ZZcIi8NOLAH140HPrA60FptNK8PFFXPgMsRnlYc6:xiOTkRbj9FPghn2B
TLSH
T1D0C229F258E72836D9AE6347A3BE3D025EBCD02775845A0077D8561DCD9A27FC306C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6f7bba13042de601dad5ff4816d302a0fba80c3966989b142426a63eb702946b
MD5 7734b8e94ecc7220e0022aa6fca382ef
SHA1 7b35daf2e026f8c65b93ac9cc6c165008e73e211
SHA512 06e9e675ccc8769a96729b0bacba575b4ccd9e124ae145b91835b7bad131f05460e979dabad12eed5d421da482e7bcce3716e2063be71beaeb72714efd2fc5d6
SSDEEP 384:cZcIu8NOLAH140HPrt60FptNK8PFFXAgMsRnlYc6:KuOTJRbj9FAghn2B
TLSH
T14F928E339C347C77ADFBA545B48735039EF4902BAAC4AF4499EC9B1D02DA69C0306D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 abe4764a455a8e06a3669a54f81a4e5495f9067854eaffe4313c112d6d8b829f
MD5 b135d00b546f4cfbb9762243a71f0f18
SHA1 65b6bc829340258684c64b93428a8a8715f2ceed
SHA512 c22349a42688368f5ac9d808e7faff703ac4159313b333d6331a2e10391c7f8a7656c90de009ee715f9cd4f17ff60475e6cfe0a3584e9fee91df5678f8a1fff9
SSDEEP 192:KGN36d940pQmiUyVc7mBF2oP1NmjzorPXFFX0iDeq0U6:KGN36740HkMmBFptNK8PFFXtgU6
TLSH
T12012EA3668387C7B9DE3A994B08736136EE54127DE887B40DAEC1F1C01EF29C5346D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4c74b4c13834126c237099266f4addc8564693d9c32482baf89957acc6979d14
MD5 371f9a6ffe57fd66d25abed5fd42f830
SHA1 4397dccce6290c4f3a90ad696419b18bbe6f94ef
SHA512 5b1ec72a9b4a7da6c3018d09835c9513aa5451a229b1a0677e97d2d247ac086281992b533a8e9f4e05971ef3126ddcd87543bd1bf759a59b5cc2ca8623990311
SSDEEP 192:uUg8NOY9naQT8gRJ940HZfQmiU1VhHl40F2oP1NmjzorPXFFXHpWeq0U8:+8NOeaAH140HPrt60FptNK8PFFXAgU8
TLSH
T11F420A366C38AC779DE3A554B0873613AFA5402B9AC86F44DAEC5B1C01DF39C531AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfdb920c-f070-4905-90eb-fe73d1c2e7ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dfdb920c-f070-4905-90eb-fe73d1c2e7ed.tmp
Size 8KB
SHA256 33d107bfbbdbab4a3500a85ed9af9a89dce06f7248fb4fad46f79111f25be982
MD5 f80328769e09e952baf47683430c1d2e
SHA1 80ced3a0d32fcc043ae1aa62aed786271bc8da94
SHA512 4e39df91d306c261221b8839af9a192b5c1db47a6121c1432493f7a104842ce2df3ab0030b8169a7fa9f8944361efc22d408aaa565f1e5f5dd9f8c0501b78830
SSDEEP 192:qGNb6d9402QmiUyVgv7TBF2oP1NmjzorPXxGwCp9U6:qGNb6740SkgDTBFptNK8PHkU6
TLSH
T1D302E9356C383CBB9EF36E49B4473B136FD5112BAA946B44DAF81B1C01DB24C2346876
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download