hxxps://us[.]list-manage[.]com/h9OwKaPaz_g?e=f1fad20e59&c2id=ee853acd6f6f2ffefd93633b9bfa3579

Resubmissions

10/09/2026, 00:53

260910-a8qd6ack7w3

10/09/2026, 00:48

260910-a5tx6svxdy3

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://us.list-manage.com/h9OwKaPaz_g?e=f1fad20e59&c2id=ee853acd6f6f2ffefd93633b9bfa3579
Sample260910-a8qd6ack7w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4840	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334752224524277"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{B2E6C77C-812C-453C-98AF-3079DB1F615B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 5112	1740	msedge.exe	84
PID 1740 wrote to memory of 4840	1740	msedge.exe	85
PID 1740 wrote to memory of 4724	1740	msedge.exe	86
PID 1740 wrote to memory of 4724	1740	msedge.exe	86
PID 1740 wrote to memory of 4724	1740	msedge.exe	86
PID 1740 wrote to memory of 5108	1740	msedge.exe	87
PID 1740 wrote to memory of 5108	1740	msedge.exe	87
PID 1740 wrote to memory of 3364	1740	msedge.exe	89
PID 1740 wrote to memory of 3364	1740	msedge.exe	89
PID 1740 wrote to memory of 3364	1740	msedge.exe	89
PID 1740 wrote to memory of 1352	1740	msedge.exe	90
PID 1740 wrote to memory of 1352	1740	msedge.exe	90
PID 1740 wrote to memory of 1352	1740	msedge.exe	90
PID 1740 wrote to memory of 1236	1740	msedge.exe	91
PID 1740 wrote to memory of 4928	1740	msedge.exe	92
PID 1740 wrote to memory of 1236	1740	msedge.exe	91
PID 1740 wrote to memory of 1236	1740	msedge.exe	91
PID 1740 wrote to memory of 4928	1740	msedge.exe	92
PID 1740 wrote to memory of 4928	1740	msedge.exe	92
PID 1740 wrote to memory of 5048	1740	msedge.exe	96
PID 1740 wrote to memory of 5048	1740	msedge.exe	96
PID 1740 wrote to memory of 5048	1740	msedge.exe	96
PID 1740 wrote to memory of 3892	1740	msedge.exe	99
PID 1740 wrote to memory of 3400	1740	msedge.exe	98
PID 1740 wrote to memory of 3892	1740	msedge.exe	99
PID 1740 wrote to memory of 3400	1740	msedge.exe	98
PID 1740 wrote to memory of 1728	1740	msedge.exe	100
PID 1740 wrote to memory of 1728	1740	msedge.exe	100
PID 1740 wrote to memory of 1728	1740	msedge.exe	100
PID 1740 wrote to memory of 1788	1740	msedge.exe	102
PID 1740 wrote to memory of 3736	1740	msedge.exe	103
PID 1740 wrote to memory of 3736	1740	msedge.exe	103
PID 1740 wrote to memory of 5000	1740	msedge.exe	112
PID 1740 wrote to memory of 4928	1740	msedge.exe	113
PID 1740 wrote to memory of 1804	1740	msedge.exe	114
PID 1740 wrote to memory of 1496	1740	msedge.exe	116
PID 1740 wrote to memory of 1496	1740	msedge.exe	116
PID 1740 wrote to memory of 1772	1740	msedge.exe	118
PID 1740 wrote to memory of 1772	1740	msedge.exe	118
PID 1740 wrote to memory of 2520	1740	msedge.exe	119
PID 1740 wrote to memory of 2520	1740	msedge.exe	119
PID 1740 wrote to memory of 1244	1740	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://us.list-manage.com/h9OwKaPaz_g?e=f1fad20e59&c2id=ee853acd6f6f2ffefd93633b9bfa3579
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x20c,0x7ff8bba5c188,0x7ff8bba5c194,0x7ff8bba5c1a0
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,10238261236624900006,1582420639982586249,524288 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,8362795607199335903,3444615558810626985,262144 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,12290700743712609956,554748658128738720,524288 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,7347985560992552296,14144482942388698499,2097152 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,16123980920467562004,13959776289444814473,2097152 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,10771382486841683087,14540964123997358881,2097152 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,148913449459187917,9624864897023363345,2097152 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5068,i,18230221241510725614,2225645122593618018,2097152 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,18075215741372880076,9730817565228032822,524288 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,7495838125858376970,17104919349786418917,524288 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6244,i,4975114111291854413,11960397813224892268,2097152 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,16393238845583087533,17696058080479935747,524288 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,16393238845583087533,17696058080479935747,524288 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,9581107384310219879,14794943729952879828,524288 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,1573535222064002014,11813564473276570229,524288 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,7121503411920737979,18210927611542896853,524288 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,6649056357343984225,17529488961982071718,524288 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,15038469490353295110,9958199939135119119,524288 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,2950458488461858839,9974375603207259216,524288 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,860227727101657201,17286026200546915363,524288 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6508,i,5412908101161686726,1352559486387441119,262144 --field-trial-handle=2332,i,630486713387988400,2757909641494637449,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 558B
SHA256 d7022087e0085178299f4b4b6792285535ff1a17632309a49c160500efe6352f
MD5 3a4e762ba9a9a2d6d7c605ba3b19790c
SHA1 c77e309d3ae3bceb412557c947d763f5c079f32f
SHA512 71e2ab986650b22373baab62836c7347c37b08fc464207b4513f82bbcbb298fdd5226e4e2a1ac1696feaf379cff88678599f93163fd1506f6d92b30ffcc09e0f
TLSH
T1CDF0466A5381DE6DE742638A82C476086461FB8BEABCDA5923C464CC788813CDA7D1A5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 344KB
SHA256 c1ba7027e790c346842569dc60319a75bb54ad9875b3a114cd3d60febdc1ecb0
MD5 a76556d1143eac7869c5cdd2ba75aee7
SHA1 62ace25f7a400460ef1550bd536b8006aff57655
SHA512 b6763ac3d83198054c3e24685aab797d60c39df22f0eeed2ff4217bbfb891efa1f2ffda857b079443e0ee66fa3e0b2f1cca34867fcdd8a709b88abbd93c33e4f
SSDEEP 6144:+1/dG8Lx2NjYH/1z2cvc5NFLhVke64uBSCGJ0qHQzr+LZ:+voj2hrvcdnlJWF8HQzrQZ
TLSH
T13F74231F614B6C6CECDE01C7216E44D5D32B8F52CB231ACBE649D16B04E749C8ED9A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 21b266081756d0592a20d22630b17cad3e5ca8bc25d0193d07793f1dc126c9a5
MD5 f7d48cae53bdd10c17d3274af9303181
SHA1 fc0d215b59a892441b7b4ba8c9a0dfd520d5c9e4
SHA512 2fa6be0d7a2697ed79d5593439c9dd3a44c8dbe4a4ad5502188983a8fdb85eb19ee54035c009f13fca95b6b632cea76f6b77296b3488ac7b089cf1bc1b59cccc
TLSH
T192718298E9C2078BEBA00372ECD349A677B144D46A2F4E12007DFBFC6952B64FD75404
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 fec0c7bf3fdde4af6a2e87927034f5e45949e6a20853eacb8437b5ba1bb16b61
MD5 978b260317258917e765841bfdb9249b
SHA1 5421583a05eec8885c14224bca996a4d5d01c4a7
SHA512 467c06cd6987f1b79d361fcaadeddaa2a91defb34cee4a582ef3897af233b974a4362d11725b4e8da4ddcc26be54ddcf0b8d87d7ae2944a4edf833c8f9e32e89
SSDEEP 96:DDecONU1GMyb1IzBzjKHy2TOBKl79HbowQ:DDeXNU1GMI1I1zjKS2T2Kl79HboT
TLSH
T1CEA169F3C3E9972DD91156F05A24AF2BCE1D0A14432C396A89D4EE4BE3F2572E10265F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bf24a03388196d11a984a479630077fc64da1857ebd102d8eebc9fb4d5cc56ca
MD5 0faa227b4c733a30f3dd6cf99dede450
SHA1 221e638833573d8c90364c515faf9f93aaa8ef7a
SHA512 fdabcc8519c9294c53612dbde697d5b6314eb1c2987623ac2b320030f5debac0c3f9bf115d4ca5fb8976f67c82ad645b3d4a9f86296be8e937cf95e4818bbd4c
SSDEEP 192:sxZw6RwyM/jK1Ml8MWC/ftst7IdpLVHW6+WNXmT/YH3xJayIgrJ:sxZw6GuC/ftstk5Hbc/i9
TLSH
T12F42D8166A34A97BCCCBD309F9557F53D6F50573A2901E48A9FC9A1C00E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c7debb9932813b3ffc288f8a886472b395dac9578071f4d560c5d8e78102eb06
MD5 34d2c721541b4feff63182ef5cf616e7
SHA1 07f6cd8b8c0f4cd64a696963685f65a778837f0c
SHA512 fd24e7532c0820cbfceac78f60c3ae718feb3aead224e6e024fe979aaa881a96d78503106dabf3ace1f8d77725a941c0a13bad81eb41632d3d258b4b012e713e
SSDEEP 192:sxZw6RwyM/jK1Ml8UQyWC/ftsG7Idp9VHW6+WNXWC4XYHjWMiayIg5eJ:sxZw6GqNC/ftsGkDHbX4XYA8
TLSH
T14F52D7166A349A77CCDBD209F9417F53D6F5057292901E48A9FCDA1C00E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 179bd04400345a88872718e845af115ec6149b3e50461c3d7d4ccce20bec44d1
MD5 0e8f060855f445d3f973a4bf3cf34278
SHA1 a8c127fd72742145f19a60539651122dd627dff4
SHA512 a4ed389ed318cfc49782d9cdc8d43648c6764cd19e181d69eb600e13531a0a587f5880bba26601c30d3cd9e767e74481a8640f967b59e92c46a734a26760c186
SSDEEP 768:4fUZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R7roVL0g:4fUZYTMWvg09ou1ja7eLZmRIug
TLSH
T141E20B2F280CCB7E4F844E9DEC2AAF963ED801CB5A584D5447EA894C02CB7EF511759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d134adc6319bf400d5cd70e4f68c316a708e78db7a18eb5c8a0877e2f3cf909d
MD5 adc4e89ab4e0a1bf8d41efa3e7d31483
SHA1 2f84386a77ea821c3e330af236f53bd9fc2feb6e
SHA512 0221aa571ddb990190a64dfa7a52559ce53dbcab9dfea4d6b12ffccab5b1b469d7b8d2d529f6949fc87499e6aedc6ec7f15ead6e2fede35822b488e0d3f2d0bc
SSDEEP 96:KA1eK2AseUKXqlmd+KuARvmK0UyiQAKlil:EWE1r9n6
TLSH
T143D1E31271BA13113C7D2A1C86B59B668E417563702DA52B7FED00B54E2AE209FFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a74c828-2f0c-4399-8a2b-c77e5dc9e9f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4a74c828-2f0c-4399-8a2b-c77e5dc9e9f0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 690491a6474b7a69f0b6af94a996e830932f7b462aacdd830b46c60bf2024d7e
MD5 88c7fcfbff25e0a49cf9f241b51efb0e
SHA1 d761c6e0d89fb76291f5084c954005adea12a2ec
SHA512 0ebcaa948a261ca6f7946b18af42a96d04de4facbaebe3d5e3180f43b4c8922ff73abb7e27c42b7ecf91d961fed1b5e6f7443e4830d38821f1004cb9d734a414
SSDEEP 384:hZcIhsNcIgnC5wuzX5od+2d6/Id+2CLThxuvzxV+MhdppB3oA:phjAROv3lCLTh4184ppNT
TLSH
T16B827E3168286C778DE6F245F88776134FF880779BC86BC4D5EDAF1D009A6A9131EC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7496cc2abfdd0b8fc18fa70c2f68b099cd1bc8df5215137ccc223f2e351c496e
MD5 0f86a9af0560deb1ee14c426db6b42f3
SHA1 17cc645fe36e0db882c86a4796cb6fc15fe6dcd1
SHA512 aad4d3e16d36a750e4ab2ef7bff947059858685a73e15925bd14896d2f715401f308b9b61a28e11435a4973a391c9951cac2b62739efa11a8a6465aeedcde7bf
SSDEEP 384:ViFiZcIJCsNU8TUNTUlIl9gnCKwuzX5od+2d6/Id+2CLnhxuvzxV+MhdppB3oA:cFQJCJwg8/ROv3lCLnh4184ppNT
TLSH
T1F3C21AF158D79876D9AEA743E77E3D024EBCC067B984A680B3985A1CCC561BFC30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 738e9d21d7b06025ed562aa7118af3e23ca72816e147dfc6cf94e6e033aa3d07
MD5 fbf4a4b2248b8ff5e055eb3ccbe67cc9
SHA1 f57ce46d86592f1fc280ed0044fbdf7b27626a24
SHA512 83e55502406bab74e28e5d3a7d7635ff3e3eb326920df642568abf6c6dec5df7820571047793bf0702e566b319a873a6b7216f2e259c0941cb28939701b72820
SSDEEP 192:yONI61VWQmiUyqbgGX5Obd+j1+FdgX/t/aP3PXU6:yONI6WPgGX5od+2d6/wnXU6
TLSH
T18302C73568687C6B8EF2BE49F48777135FA42167EA952B84DAEC1B1C009765C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 20504e1bf1096a68ede7a547ec6f62f978b16b9e363979c4bf18c6c3cf91068c
MD5 030bb07c72eb366cb2968e52d372832f
SHA1 131b1e347329f2c6cc3ff2b3fe7090701b34ad76
SHA512 100afa0bf2dc2a1793464b5fce6e06ee9076d5db014170ea3ef8f9afdc8270d87df79dcb828e4e33f7c8a294cb8c024786bacc4212ba1fb466d37b0f12c3c4b6
SSDEEP 384:0ZcIhsNc9gnC5wuzX5od+2d6/Id+2CLThxuvzxV+MhdppB3oA:yhOAROv3lCLTh4184ppNT
TLSH
T171826E3168286C778DE6F245F88776134FF880679BC86F84D5EDAF1D009A6AD131EC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ad2e6047d044ba388ed8b77a2e64726bf547a2e8878f4d5784f95cb9521f7a46
MD5 45bb9686dbf3d92781612790f8690582
SHA1 14d7ff51ffb1dec1cfb421202f087d2e2c3d65a7
SHA512 b15a91987a73406e0085b0ac80b3a536970bf0328c93df8738bd420e9b562e7ba9b12367fbc6d35cd936758842ce682e97f12acb75950018aa92e2aa31c96f42
SSDEEP 192:GON161HWQmiUyNbLGX5Obd+j1+FdgX/oxFd+2CLVjJYQqWU6:GON16M+LGX5od+2d6/Id+2CLnhU6
TLSH
T1221219316868AC278EE2BA55F48735134FE55167EF897BC4D1EC2B1C01EB6AC234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

236b181a-1290-481f-b8e8-aaccf76f10ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\236b181a-1290-481f-b8e8-aaccf76f10ae.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4f2c5d2de1a601670213e061afbe52f725246cbc47f377df3844e0f6701bfdc0
MD5 1ee5361b58768e7f65212794b7baf9e6
SHA1 f86eb8445c31a3f3b72e07d44b44e19b6f404d4a
SHA512 c71173ec91f3b7d04483ab6f933d1da1ad4347ef1781d8b7a0cba3d70774f17b33e176c4469a2bcbdf3206f486918466b29ac0e1ed09c94a064f2d035207ba68
TLSH
T1ED412758BAFE1148B3B36E5A9BF2786E447FB9372E0AD56D10110D4F0A23B40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download