hxxps://click[.]mailchimp[.]com/track/click/30010842/samhsa[.]us4[.]list-manage[.]com?p=eyJzIjoiRHZ3bnJZN0Fld1pTbWw4cnhyakswdDdpWFM4IiwidiI6MiwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3NhbWhzYS51czQubGlzdC1tYW5hZ2UuY29tXFxcL3N1YnNjcmliZVxcXC9jb25maXJtP3U9ZDA3ODBkYzk0ODI1ZTY1YWNkNjFjMTdkYyZpZD1lZTFjNGIxMzhjJmU9NmNmYzY3N2QwZFwiLFwiaWRcIjpcIjY2ZGM1YzNiNmRjZDRiMzA5MGNhM2UzZTNmMDk1YTczXCIsXCJ1cmxfaWRzXCI6W1wiZTFkYjIwMTkyYjIwNTllMDlkYjNlZmI3YjAwNTA4YzJlODliM2UyOFwiXSxcIm1zZ190c1wiOjE3OTAyNTkwNDF9In0

Analysis

user interaction
yes
max time kernel
44s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://click.mailchimp.com/track/click/30010842/samhsa.us4.list-manage.com?p=eyJzIjoiRHZ3bnJZN0Fld1pTbWw4cnhyakswdDdpWFM4IiwidiI6MiwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3NhbWhzYS51czQubGlzdC1tYW5hZ2UuY29tXFxcL3N1YnNjcmliZVxcXC9jb25maXJtP3U9ZDA3ODBkYzk0ODI1ZTY1YWNkNjFjMTdkYyZpZD1lZTFjNGIxMzhjJmU9NmNmYzY3N2QwZFwiLFwiaWRcIjpcIjY2ZGM1YzNiNmRjZDRiMzA5MGNhM2UzZTNmMDk1YTczXCIsXCJ1cmxfaWRzXCI6W1wiZTFkYjIwMTkyYjIwNTllMDlkYjNlZmI3YjAwNTA4YzJlODliM2UyOFwiXSxcIm1zZ190c1wiOjE3OTAyNTkwNDF9In0
Sample260924-rtccesvs9p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3820	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347337307037759"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{08ABDDDC-B49D-4B77-9F55-972AAD61B0BA}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 3064	4704	msedge.exe	91
PID 4704 wrote to memory of 3820	4704	msedge.exe	92
PID 4704 wrote to memory of 3932	4704	msedge.exe	93
PID 4704 wrote to memory of 3932	4704	msedge.exe	93
PID 4704 wrote to memory of 3932	4704	msedge.exe	93
PID 4704 wrote to memory of 3772	4704	msedge.exe	94
PID 4704 wrote to memory of 3772	4704	msedge.exe	94
PID 4704 wrote to memory of 1836	4704	msedge.exe	95
PID 4704 wrote to memory of 3856	4704	msedge.exe	96
PID 4704 wrote to memory of 1836	4704	msedge.exe	95
PID 4704 wrote to memory of 1836	4704	msedge.exe	95
PID 4704 wrote to memory of 3856	4704	msedge.exe	96
PID 4704 wrote to memory of 3856	4704	msedge.exe	96
PID 4704 wrote to memory of 4760	4704	msedge.exe	97
PID 4704 wrote to memory of 4760	4704	msedge.exe	97
PID 4704 wrote to memory of 4760	4704	msedge.exe	97
PID 4704 wrote to memory of 4776	4704	msedge.exe	98
PID 4704 wrote to memory of 4776	4704	msedge.exe	98
PID 4704 wrote to memory of 4776	4704	msedge.exe	98
PID 4704 wrote to memory of 3952	4704	msedge.exe	102
PID 4704 wrote to memory of 3952	4704	msedge.exe	102
PID 4704 wrote to memory of 3952	4704	msedge.exe	102
PID 4704 wrote to memory of 2860	4704	msedge.exe	103
PID 4704 wrote to memory of 4812	4704	msedge.exe	104
PID 4704 wrote to memory of 2860	4704	msedge.exe	103
PID 4704 wrote to memory of 4812	4704	msedge.exe	104
PID 4704 wrote to memory of 2964	4704	msedge.exe	110
PID 4704 wrote to memory of 4772	4704	msedge.exe	111
PID 4704 wrote to memory of 4772	4704	msedge.exe	111
PID 4704 wrote to memory of 872	4704	msedge.exe	117
PID 4704 wrote to memory of 872	4704	msedge.exe	117
PID 4704 wrote to memory of 872	4704	msedge.exe	117
PID 4704 wrote to memory of 4848	4704	msedge.exe	119
PID 4704 wrote to memory of 4848	4704	msedge.exe	119
PID 4704 wrote to memory of 4848	4704	msedge.exe	119
PID 4704 wrote to memory of 3456	4704	msedge.exe	121
PID 4704 wrote to memory of 3076	4704	msedge.exe	122
PID 4704 wrote to memory of 4828	4704	msedge.exe	123
PID 4704 wrote to memory of 1868	4704	msedge.exe	125
PID 4704 wrote to memory of 1868	4704	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click.mailchimp.com/track/click/30010842/samhsa.us4.list-manage.com?p=eyJzIjoiRHZ3bnJZN0Fld1pTbWw4cnhyakswdDdpWFM4IiwidiI6MiwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3NhbWhzYS51czQubGlzdC1tYW5hZ2UuY29tXFxcL3N1YnNjcmliZVxcXC9jb25maXJtP3U9ZDA3ODBkYzk0ODI1ZTY1YWNkNjFjMTdkYyZpZD1lZTFjNGIxMzhjJmU9NmNmYzY3N2QwZFwiLFwiaWRcIjpcIjY2ZGM1YzNiNmRjZDRiMzA5MGNhM2UzZTNmMDk1YTczXCIsXCJ1cmxfaWRzXCI6W1wiZTFkYjIwMTkyYjIwNTllMDlkYjNlZmI3YjAwNTA4YzJlODliM2UyOFwiXSxcIm1zZ190c1wiOjE3OTAyNTkwNDF9In0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffeeca0c188,0x7ffeeca0c194,0x7ffeeca0c1a0
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,3044390058317417444,9795895565740679221,524288 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,13322912746629509163,12655344286625461146,262144 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,17334051490122666948,2904116123023611378,524288 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,16108541015354384565,16056915079246919384,2097152 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,6980155662365599979,5046900316471567759,2097152 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,12330757493405012756,829893004293057276,2097152 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,7666299656209527906,10861168217840085463,2097152 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3444,i,16820296104687789704,1560118153995495486,2097152 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,8087868540578687443,4540762496022757829,524288 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,929982283345290221,5391542455568644612,524288 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,18144495058297482607,5819197935192670983,524288 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,18144495058297482607,5819197935192670983,524288 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,12458494773760971527,2785726550691438310,524288 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6468,i,14014561134932291853,1919822351384490398,2097152 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6428,i,5976547428781429392,15289566620156459878,2097152 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,9649832620093493586,6787491999013560777,524288 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,2859826599533235640,14221789107044919802,524288 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,14164959254671010237,13229646109382346148,524288 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3300,i,13789790086928121832,4463687276503078022,524288 --field-trial-handle=2316,i,4933160348341756574,12278464677440306823,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:8
  2⤵
  PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb29521835d0887aef733d211fa43d2903333bb5e86e2580dbfe7db3b16bb1ca
MD5 ae441104cfb514988d8468c296b33f4c
SHA1 1de1bdd3ad0b87ba57d165cd0d5b72d99a1a48f2
SHA512 4178d6169908ca49fae4773c8986a0c9d71a515b2fb4d7ce8fb9bcc8b10c415ac00698c7add7cc45f427547535401a518211221bcfe6dfc2bdc0f71f62b0105f
TLSH
T150D0C028AD78EFF4F021113C0330400031CF88138642210A58610D174C302C30380DF0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aaf12a66b7004757114d7ea1dec4f26617e63645bf213791f9b887aae438376b
MD5 a680813fa4c7a277c4bec3441e7c53fa
SHA1 0029590295714d589a49323eb1c3f8ee1513b0d9
SHA512 c9f3b3a4afa667d3a5508c20be811ef7e2c14f434a32f53a8e99b5b2c8a1ed3694cf5742ee6b91f2dcd0efa2eb1bab0a7d743b1f40b18702ced5a2a96158ef75
TLSH
T1E3615C8999B00090FBFB49F355E5F48337F48A93AFB72DB5EB54C4788A0E350A315188
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 a82461a2ca233c4587d1536b766191eb70151aaedf2ead49945e99579f5eafc9
MD5 1d3629c66131b9198d3ee56ddb99617e
SHA1 0f391978490eb7689059a555eed77c8612410fb7
SHA512 e32d0acf176ae0fd38d544444208cb434e3e1c511e0d1b7c78fa4ca90986d7de6a8791e89ff1f45c2d6be22da75ed5559e88d4770bb480988248c7cdc1a81191
SSDEEP 3:MsEllllkEthXllkl2zEklg:/M/xT02zn
TLSH
T1044404447FC10405C70035307053C35443F0D5140551574F34F10433DCF5D400C01400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 72bc8fc6d4b56758dec7a617e4f0dcb1b22e2301c897f69e7a14161dd4d6fd11
MD5 7288692c5e83b45aee9bd3157bd74101
SHA1 b73efdccee20194e0b6ef5fe7a0bd74974aa9901
SHA512 919e98c36532afedaeccb3c96ee47493cc3100de7be224f7432837030831a762730cf8f02c586cd3ef36f875b8b42bc87ea9ea0ce9150b8f92e9863a5d3052fa
TLSH
T1A32190F787F5996E8E0191F0AA186E1FCE2D0515432C7C2AC5D0AF2793E3471E10154F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5577d1b202e5379c816cd941193ca8efb5aebc7897c95e134a581944c6b8d42a
MD5 02936a64928a90c1bd098b482014f8d3
SHA1 7e7e603c1409801a52f3fdc7a19e6309e6eb04cb
SHA512 8fdb2d219bbfc39badb3537ef9ebeee6d2867f59585058d0b386da46a3c3ffeb93eb92eb3fd9335a0da59582ff3e4c8a012df1da0cc14783dd916fc5ca8a00e5
SSDEEP 192:sxZaRAWQ/fNs/bIdpEfHW6+WNCC2/Y3L/fIgrJ:sxZa9Q/fNs/EqHbO/A9
TLSH
T14522C6126E38A97B8CC7D20DBA65BF53E6FD503291D45E48A6FC8A1C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0fa288fef2c1bc1c8e59fda08496288126f33e7af3335dbaf08a590ce5aa1607
MD5 16d3bbffe4d50d3334b8c825970e0d2e
SHA1 ee8d406fc5e43e9cccff35a91c6575ed83af19da
SHA512 aa7ccc6034a1d0e4f8370228b255fd31ca10a8dea98408b1df2f14e0f94a4f88e2dbb916432daccb981e209963b6cd54abec1700282dd354539f0b596196d7a4
SSDEEP 192:sxZaRAWQ/fNs1sIdpETHHW6+WNCC2/Y3L/fIg5eJ:sxZa9Q/fNs11iHbO/Ac
TLSH
T11622D7566E38A97B8CCBD21DBB65BF53E6F9403291D05E48A6FC8A1C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 20c0a23382ddd78d17c9f04355323ef761e82db5d8c53cc79aa77be0e84c97a6
MD5 11adea64153f64d60bfea06f0f6dbe3f
SHA1 fc31f1d5f204c9e7236dd0f85d8761d3334abe09
SHA512 258f577ad712c3bd6f22f6bd55ea7b2c5fa7a6a34e2908f4ee199915f088a7a7fb5817efbc667fe872554ce7beba59717b45dc909888508077599059bf867eea
SSDEEP 192:sxZaRxtWQ/fNsWWpVpxIdpEbHHW6+WNtsrVC2/Y3v7pIgb0J:sxZab0Q/fNsWWvp6CHbmd/4M
TLSH
T16832E5566938A97B8CD7D20DBA65BF53E2F9103291D05E48AAFC8E1C01E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a7af7aa5002beddb6eefef7adc9de79ddb139145b6231ba92b275f4a2731ea83
MD5 7e9c4b0ead9925abe10e3c5e13f96a1d
SHA1 ae09988061a4feb17536447b43d86d0eee910478
SHA512 627550246713def55e678e288fd829ec3d2b1cb7b1eed28399ed73436cb4aaf35d4830f55efd03ee72eb8f579726899e908fd6e94b9c79d937152d9bd2648c52
SSDEEP 768:hL30AbSWvS2998F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72mrolZMe9:hL30AbSWvS299u1jaLmLZ12dx9
TLSH
T136C2EA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796648D4447FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a210d5f6c2aa4541fe9f9c68fbfb6018b2155f37e2f062cd50cb145c97cdd520
MD5 aaa5b0eecd101e31f24d38157f9d7eb2
SHA1 b10f5c59ca987de79db59e31e7fe38cd505b04a3
SHA512 eeab1dd1575690dcadec841f1f25fce5db722a65c9c9f4005b00e3eda170e07c01ec20b922b052743cc3ab79399be196746571d0453c7ad7b7ad8de9ca9ac096
SSDEEP 48:K0YH+CIyWXbOVOISaXK921sXxgHYd+G8yLHqTnpJZybRcBIS3yK931dyx3iYUFtD:Kg/mKskqS0IKZe6qwKnKGaz
TLSH
T1BF91241034BB125939BD244990A0D72E864231E331ACF56BBFBC51A25E6BE140EFEDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 c1cb42190cb8293624a61b8c715180bb28a989d357cbaae47a1f884cc22a76e7
MD5 1958fb8a5e1f5cc0d4a90fc1f200bcfe
SHA1 4f4d42dfc739942c4b31340a28b274f24086040d
SHA512 85c8d412445d24590e6c6989120df515425abda86da5659c30e2bddc9a71fe1b1ac0b3b57da8e1f500d7d10190495abdd63e3e5f25414662b5396da4a215c890
SSDEEP 384:uZcIhsNlZEWnHspu1bMN9iX5Fgrb8ASwDb5oBMKwIr+L0/upa7dLKkMQKoi:MhRiHshzaOfSjyKwIr+L0Sa7dLKkMQKd
TLSH
T1BCA238B6D8A45CFB04A6E1C0A446F9036EB84137D29C6E4CD5FCBB3D309F5B81726926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 811e55474b14389c56f0136927604223f6139751abbb3022926f37cadf315f2b
MD5 ffb20f6106eece5972584b73d9ce8e2d
SHA1 48fccc68cf49880dc37d79ee75998c4daadfec11
SHA512 87c7a042e998c6b834162908626a09ae24a67d8cd5de19cb3ac56caf0e4c6c9a371c851d81f5a1ba007d7c6e58568b5f686ef36d0319ea90718691ac518e0ec0
SSDEEP 384:nZcIhsNUUEWnHspu1bqp9iX5Fgrp0/upa7dLKkMQKoi:Ph5iHsRnaOp0Sa7dLKkMQKd
TLSH
T10A828D729CB85C7B09F6A210F44B7A035EF8806BD7986F88D9ECAB1D05D6198130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a483653d7f390d6e7763492028d3b020309e5c55719d52a7a990410be6532b48
MD5 7c98198ffeda495fd75d4618a5cfdbb3
SHA1 6c3e47c323ae2a57d7c5b616f9b6ad0a6a6f2720
SHA512 7bcee471512e620c3cee1df5f1aabe70e69dbf724262396b1cde44d5e1eb6af8eb2d36334a94151c5737edb0adbf2260bdbc97c81f689f200893bcaf73aa6c79
SSDEEP 192:LONF6Amwp4QmiUyDaRrLsiX5F1RY369lR0/WrU6:LONF6ipYVLsiX5FgGpU6
TLSH
T168121A36A8B8AC7F4DD2A550F08735135EE9422BDB897F95D9EC2B2C01DF598430A823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f21892665ebd7b8f9dabc8dde9878c7cf8ca8bc2df3fea29d0e802e4386e9c1b
MD5 f2373b03107555b9a9715a8ee6c99ce7
SHA1 afb0863cf6737dd5d6b07ec7b6a68dc24aeebeb5
SHA512 254b0e969bb3dad0b288bab2b2f661116f5ee03c4070285b992415c2f8c6afd7aaa6a985b46e200e87428b6f7472781e7a7aa54234319464758366d221df508d
SSDEEP 192:LONP6AmwprQmiUyDUr6siX5F1RgJipCU6:LONP6ipdX6siX5FNYU6
TLSH
T12102FA35AC686C7B8AF3AE05B48B3A136FA5106BDA956F44CAE81B2C01D764C1307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6a703b94edcbc3eeca2f08fdc3408db52482092e79d7d2c7232b4150ed504ca6
MD5 f7ba5a99f21175f6d99c77ccb4b02d59
SHA1 28f46e77c3051af2aa2b7cc95c5ffa95b3f028e1
SHA512 1bad3c4c402d53c6a3cda5c1ef44212969bb4128b44e9ee80ec442546525416ed0ffdd941f32e81f59ea716fcb99a03d9c304327ddc52b9edfda81047ddc9124
TLSH
T118E00243530000D5C114033000471A305AF3803001A106545E1509581F233002E10744
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9221fad163a5516e27edc8a8d30377465c3a0c0c94590c5b7552626b8f77b9bd
MD5 af81a41f873e00101b95a20d3024537c
SHA1 ec0152187473efd1fe14912b281778f8d82ee7a6
SHA512 7733dcc4dacaa69bd070e715c57310c2a8007589d0e4c2037f78e94802bbbcab0215a4238a19ab639d0cddfd04bf7a950909e16be59b936cbc8d97672266bc30
TLSH
T1BFE00243535508DAC524033000871F306DF3803002A207565F15456D1F333407F10788
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe593389.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe593389.TMP
Size 392B
SHA256 540f798a06b35ccc6d98e40e239a43ca976a0fd13b7a986c7d604c3c3771b969
MD5 a306a294692aa686b204da87d53c70ea
SHA1 b9ed3cee31be3293ff2d41f9cb40c0fd551f9913
SHA512 29f4d329c91856fc1818839783818efad8278cf4274b1d885dc6f8b19fa9c764859807bd89d46afca63092a3a8ddd3a005f881fa48774ffc2bca585b07b9f3a1
MD5 SHA1 SHA512

Submit Download

5d7d0d6a-2292-4fb4-a519-d5803d3337ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5d7d0d6a-2292-4fb4-a519-d5803d3337ff.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 ad479373a30c4c02e65a54773bfacbfad32f148315ad202f1bb62467dd674a33
MD5 14e2ee9670a9d8c92d350d0b3b778a00
SHA1 747ac1ddebb0f7674d457f02c2022c5386fc9e96
SHA512 efb18a0642813475748d294d73ec1b3def9feadd19f4bb5743cc213cce1725566bc97528f01d2c7853607f41562ca8784e258d8f361d876406a55e0e48b5685c
TLSH
T141512C687AE91058B3B76F569BF668AE887BBD772F07805E10410E4F4A22B40D861737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads