hxxps://e-eu[.]customeriomail[.]com/e/c/eyJlIjoyMzQ1MjYsImVtYWlsX2lkIjoiZXhhbXBsZSIsImhyZWYiOiJodHRwczovL2lkaW5nby56MTMud2ViLmNvcmUud2luZG93cy5uZXQvM3h6Lmh0bWw_dXRtX2NhbXBhaWduPVVudGl0bGVkK0F1dG9tYXRpb24rM1x1MDAyNnV0bV9jb250ZW50PVdlbGNvbWUrdG8rTXlBcHBcdTAwMjZ1dG1fbWVkaXVtPWVtYWlsX2FjdGlvblx1MDAyNnV0bV9zb3VyY2U9Y3VzdG9tZXIuaW8iLCJ0IjoxNzkwNjcyMDk0fQ/16f64ff42c87e65aaccae6beb0f424fd32974d7885d7729a4cd265ec5f459a0e#b2ZlcnRlQGNhcmFuZGEucm8=&pcnt=3&page=_adobe

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://e-eu.customeriomail.com/e/c/eyJlIjoyMzQ1MjYsImVtYWlsX2lkIjoiZXhhbXBsZSIsImhyZWYiOiJodHRwczovL2lkaW5nby56MTMud2ViLmNvcmUud2luZG93cy5uZXQvM3h6Lmh0bWw_dXRtX2NhbXBhaWduPVVudGl0bGVkK0F1dG9tYXRpb24rM1x1MDAyNnV0bV9jb250ZW50PVdlbGNvbWUrdG8rTXlBcHBcdTAwMjZ1dG1fbWVkaXVtPWVtYWlsX2FjdGlvblx1MDAyNnV0bV9zb3VyY2U9Y3VzdG9tZXIuaW8iLCJ0IjoxNzkwNjcyMDk0fQ/16f64ff42c87e65aaccae6beb0f424fd32974d7885d7729a4cd265ec5f459a0e#b2ZlcnRlQGNhcmFuZGEucm8=&pcnt=3&page=_adobe
Sample260930-tzmfpach89

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2632	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{0A88ACF8-B703-4214-B8CE-7CC68C76AC4E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6040	msedge.exe
6040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2140	1244	msedge.exe	90
PID 1244 wrote to memory of 2632	1244	msedge.exe	91
PID 1244 wrote to memory of 1408	1244	msedge.exe	92
PID 1244 wrote to memory of 1408	1244	msedge.exe	92
PID 1244 wrote to memory of 1408	1244	msedge.exe	92
PID 1244 wrote to memory of 5040	1244	msedge.exe	93
PID 1244 wrote to memory of 5040	1244	msedge.exe	93
PID 1244 wrote to memory of 4284	1244	msedge.exe	94
PID 1244 wrote to memory of 4284	1244	msedge.exe	94
PID 1244 wrote to memory of 1280	1244	msedge.exe	95
PID 1244 wrote to memory of 4284	1244	msedge.exe	94
PID 1244 wrote to memory of 1280	1244	msedge.exe	95
PID 1244 wrote to memory of 1280	1244	msedge.exe	95
PID 1244 wrote to memory of 920	1244	msedge.exe	96
PID 1244 wrote to memory of 920	1244	msedge.exe	96
PID 1244 wrote to memory of 2956	1244	msedge.exe	97
PID 1244 wrote to memory of 920	1244	msedge.exe	96
PID 1244 wrote to memory of 2956	1244	msedge.exe	97
PID 1244 wrote to memory of 2956	1244	msedge.exe	97
PID 1244 wrote to memory of 3596	1244	msedge.exe	100
PID 1244 wrote to memory of 3596	1244	msedge.exe	100
PID 1244 wrote to memory of 3596	1244	msedge.exe	100
PID 1244 wrote to memory of 676	1244	msedge.exe	102
PID 1244 wrote to memory of 2588	1244	msedge.exe	103
PID 1244 wrote to memory of 676	1244	msedge.exe	102
PID 1244 wrote to memory of 2588	1244	msedge.exe	103
PID 1244 wrote to memory of 4044	1244	msedge.exe	104
PID 1244 wrote to memory of 4044	1244	msedge.exe	104
PID 1244 wrote to memory of 4044	1244	msedge.exe	104
PID 1244 wrote to memory of 3676	1244	msedge.exe	106
PID 1244 wrote to memory of 6000	1244	msedge.exe	118
PID 1244 wrote to memory of 6008	1244	msedge.exe	119
PID 1244 wrote to memory of 6016	1244	msedge.exe	120
PID 1244 wrote to memory of 2984	1244	msedge.exe	123
PID 1244 wrote to memory of 2984	1244	msedge.exe	123
PID 1244 wrote to memory of 3980	1244	msedge.exe	124
PID 1244 wrote to memory of 3980	1244	msedge.exe	124
PID 1244 wrote to memory of 6040	1244	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://e-eu.customeriomail.com/e/c/eyJlIjoyMzQ1MjYsImVtYWlsX2lkIjoiZXhhbXBsZSIsImhyZWYiOiJodHRwczovL2lkaW5nby56MTMud2ViLmNvcmUud2luZG93cy5uZXQvM3h6Lmh0bWw_dXRtX2NhbXBhaWduPVVudGl0bGVkK0F1dG9tYXRpb24rM1x1MDAyNnV0bV9jb250ZW50PVdlbGNvbWUrdG8rTXlBcHBcdTAwMjZ1dG1fbWVkaXVtPWVtYWlsX2FjdGlvblx1MDAyNnV0bV9zb3VyY2U9Y3VzdG9tZXIuaW8iLCJ0IjoxNzkwNjcyMDk0fQ/16f64ff42c87e65aaccae6beb0f424fd32974d7885d7729a4cd265ec5f459a0e#b2ZlcnRlQGNhcmFuZGEucm8=&pcnt=3&page=_adobe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffa7ecac188,0x7ffa7ecac194,0x7ffa7ecac1a0
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,12931301451238157778,18052752291592887521,524288 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,1662745615830324279,16248928431429425008,262144 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,4332117350345225470,12418613537456243783,524288 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,2832919863180502960,14856501319786853511,2097152 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,15435660006637047195,15737817464766593754,2097152 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,8833677593801240043,14528622087316388594,2097152 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,8448313607972380935,3501786822774943868,2097152 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5020,i,6314796432795452831,15632921770082573779,2097152 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,17362823699715812972,4638594053716117635,524288 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,12677200419131715146,1351994930226771236,524288 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5564,i,12802690481783869383,9208521799838869949,2097152 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,17158682256910887729,14856465029966667500,524288 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,17158682256910887729,14856465029966667500,524288 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,5855828746429694679,2330849030124756300,524288 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,4692650378110145729,15422222632574688908,524288 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,6396492547395626622,12191972004796808170,524288 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1216,i,16515036814998773788,12094918227924551764,524288 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,219736149491799542,15585180245903652540,524288 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6300,i,11807169227783253831,3874765849835026503,262144 --field-trial-handle=2244,i,17167213300486737550,7422131112567115606,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5f3107c1d7a6780ef74e2a3a4557651070f2d5d5108fe92dd520889dff31b647
MD5 15b515f7aa1f8035edee0d2dc76fcd51
SHA1 96669f70e62bf52d5663c8556bbed9688d2c4a1b
SHA512 9c74dde7241c27d0af4810e0d29de825f3f83b22aa340ac49079804a67646e2bc4ab75fda1f608e9c9748123ef31eaf1237dd9275ea4986f28b2a9f37a23e8b7
SSDEEP 96:eI4x3RUkA9k/tdAehtbrNlAOt0sQX3l/ncNaNA2:149RXmkoerNllt3QHl/ncoA2
TLSH
T12DA185C04A904092DFA52238EFD51A5F3B326AB09253DE42189EED3E7F5E7965D0E202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 852a0e38479599499212910efcaa0eba01355d9c4615120912c81bb69255dbbe
MD5 1a10c2952a22e6818216dfae772f679b
SHA1 7c279386dd9ed1b1a8af21a0a3d874d3dd77c0fe
SHA512 0ac096866621f17f07b4bf0d95b2fd0a7eae4e37e05d124bce734a8c4704b372cd4e83e97e1498beb355b309a1ecf87b5b72d6dc16ed7211aeef1d09988ed475
TLSH
T11E717AE7C3E4862EDA1192F4AA146E1FCE2D0A1C53383C69C9D59F57A3F2970E104A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 33614b5971989782f97dccd32552b084428b44589cd3f7272292d0d67c267512
MD5 5ec0260e864bc79521fccb2b434c8f3f
SHA1 ebf765aacd2b993db72668b1f8d697ca39d78dda
SHA512 b4d98ea8f1979a057ed0e236354994a2859a2dff9a5cc5c0c0ae92942faa632ddf82e7b5a32fbcd8b93a0d6fe11bae90d4c0f03b2ce85c0ed179567208df8a47
SSDEEP 192:sxZtuRqWu/f1sM4IdpFsltHW6+WN+Ku/Ygea+3IgrJ:sxZtu3u/f1sMJyHbG/rS9
TLSH
T1AD22B7526E64A97B8CC7D21ABB15BB13E6F94031A1901E98AAFC861C05E67DD5207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 120644d8e27877f4916ff60be20f6fa67d938da706391d6ea467539b11b45a64
MD5 9fcc6e338ef34e97d4a70add0b8d3480
SHA1 500ecf0eda6eaf913c7e2c88c4af385ba4445bb9
SHA512 a4a9b910ee11205bd38e8fd710978b08b5a67243382caa24e0c279cfc61aa8d0d10958dc502601038c4b687676b88f95bbb56272652e51b7eaa5d35645c3a8a3
SSDEEP 192:sxZtuRqWu/f1sBd4Idp/sltHW6+WN+FdXYgUa+3Ig5rJ:sxZtu3u/f1sBdJsHbOXNSf
TLSH
T1CD32D8526E6469BB8CC7D21EBA15BF53E6F9503290901E88BAFC861C05E77DD5207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e094fbe525e195956b3cacad9f384bbec10d044b4be6d403481d973744baef06
MD5 07f937665813605b9446e65b144c3224
SHA1 b74a707b6031b795a155569ec0644804298ca9bb
SHA512 cb2b76e2f69972d73b917e6e36e719928abd2dfd8504263b94a0e7e8bee98c42d525b0a01f97c525243eb795bb6a2897e383f07e2b35f5389d156e07fa2a402a
SSDEEP 192:sxZtuRqWu/f1sBd4IdpFsltHW6+WN+FdXYgSa+3Ig5rJ:sxZtu3u/f1sBdJyHbOX7Sf
TLSH
T10332C7526E6469BB8CC7D21ABB15BF13E6F9403290911E98BAFC861C05E77DD520BC0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4674a40a683e5f26219fadca0dd856c2cc3e9a08a1b545f707bcaffcb7b8d044
MD5 7c3f20488b2013d69504ad65df8e2463
SHA1 9daecaf08f4281083a735e5bbea571a0eebbddbb
SHA512 adb47e38d645a2c6de9b1d6280324925994d7aec2165b9c74be3a066d263826bc6318c903035946f10b1dd3db20a0a102d89655ba196d5d983bd64f7f727d2e5
SSDEEP 192:sxZtuRqWu/f1sM4IdpFsltHW6+WN+FdXYgTa+3Ig5xJ:sxZtu3u/f1sMJyHbOXASJ
TLSH
T14022B7526E74A97B8CC7D21ABB15BB13E6F9403191D01E98BAFC861C04E67DD520BC0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 56fc59a022dd11557dda5ab9ba6b72c2d99d2600a144cdc655465f75d97e7ecd
MD5 7d48241ffc3717051ee1db73ce2ac4cf
SHA1 9afbb44fd3915121498b181dc53d5710c8b0d7fc
SHA512 1781b7a9e2ab3d6a046f0f582a197a303477d6c23ee42e9801a5c274d5e65809af96d601b377284e71c7b057c2795289358072adee9e98ae35f326dcbcea2f26
SSDEEP 768:izichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzVro/0p:izichfPWvPZplu1jan+LKgzusp
TLSH
T162C2E93B644CCB7E4FC01E9DDD1A6F9A7EA802C7A6588D4047FA944C02C77EE91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 8229102cb20d56223159a05b7eef49e5276cf9b7ae2527454f909100f6f33deb
MD5 fd9bb6ab766c4a14c2450426aaff7d33
SHA1 8114030c01ea362fc88d7c21732eb7b912707ff8
SHA512 cd9c2a0bbd961077364942a58c984773e46b40cec4de09cd427416af682725895085498b7367dde5657b266e057b7585b878b2264295a05f0a2244d3a95f5f95
SSDEEP 48:K0bef7F99ebtAFISbeK9r1pexzOYo5L/yLnKzHJp5Sbx8hISXSK9X19SxXCY0l1k:KcooKByWSYwK1aSSUKHq+SogK9u8
TLSH
T110B1295670B707A0397D644D8175DB2E424236B23218EE6B7BBC40798E3AE4C4DFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

046ff2d0-dea8-4900-a512-7d4e52f30e82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\046ff2d0-dea8-4900-a512-7d4e52f30e82.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 07370fa93adab03b5a0a8e8e7d5c38c2b16336aea7eb141d839b5756bba521ed
MD5 602c6b8335a7090f69b3d42221f69498
SHA1 8c685ba995b290d9d55fcd292c4f67df592e26ea
SHA512 558c16adea957c344f0440e5654222601a8c7aeb79ba78d4d499d77e70c1f03408f8f269a66cc01a0d7934bc1fc9442cdd2a7b6fbcaef52dd8e3dcc347e7bb63
SSDEEP 384:TZcIhsNlUG2rVw5S3+BGYX5EiOszVSjVZh6DKhHPoS:Lh7Vw6IGYuiOsz4jfYGHPt
TLSH
T1EE828E3298B86C765CEBA542F44726074FF89117A7C97F94D0EC6B1D01DB298131BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c7c109b6eeaa54ed210531725c9ed5936671c697d7203d17e788f3b7fa94ecdf
MD5 a107b48d7e9f2efc466e28f081317f62
SHA1 94a5b4ebddfd1144c8bb800fc7ddf58b1ce36435
SHA512 fcb0129be8c57d47ffee3e39ffbbd88c662776592090c1285391a57a1cf9d105571105e59e77cf2d95a6f2dd889684a5bc76950a8beed8891c9ecfb2a3872c54
SSDEEP 384:ciFiZcIT7zsNW8TUNTUlIlB2rVw5SAF+BGYX5EiOszVujVZh6DKhHPoS:HFQTv/wgYVwJFIGYuiOszIjfYGHPt
TLSH
T1CDC22AF248E79876D8AE5743A77E2D028EBCC113B5846A90B3D8590CCC961BFC306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b0399280fef412bd24e335ffa88355daaf2c17cdcb1c9c7eba2a087de6cadf79
MD5 f1e212d95c48bc044899b46b3fb444f1
SHA1 4837f50bf54ee6a2deb9607084e929afd3466161
SHA512 684f04feee4cc0abfa86f1869fb41ecb16d1d7e76984b9d6ed452750e291bf1cc6bc0cb20e644af452a8821230968a302e1508eddbd9b4d357d74c48a16f5a78
SSDEEP 192:LJON/6DphfqQmiUyxI6wGYX59ezrCOszV3eIkII9q5sU6:lON/61AX6wGYX5EiOszVejU6
TLSH
T11A121936A8B8AC6B5DD3A951B48736034FE4522BEB847F94D5EC2A1C01DF29C530B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 dca548a4bcc874ae4cc818bff736991fbf56ed085061ce8045d03e4672641850
MD5 e638df981062c585315649e161705539
SHA1 18629dbccafeccb704c6d2f54124cfff9c8099e9
SHA512 e29aabb0b7136d446b6af56107b0796a0ff872138d677f4b584d61ff72744a80a26ceae88ba37a5fe04eaa266439e2db47157b846f4ae77882f7b5defe35de8c
SSDEEP 384:DZcIhsNlUB2rVw5S3+BGYX5EiOszVSjVZh6DKhHPoS:bh4Vw6IGYuiOsz4jfYGHPt
TLSH
T131828E3298B86C765CEBA542F44726078FF89117A7C97F94D1ECAB1D00DB298131BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 359b981288e1feaa9dd2eb078b1fad2d81b179001e3896419cfb5973384c1fff
MD5 375994fa00acc08140000e4fbd299e8f
SHA1 d424c91a400a2a9f2d062b0c5e9f286be9a879ce
SHA512 3e4c86755336ef53b20a6dbdcb0505778e68c400025883bbccf5d4ea879b9e48edae79fb3d2a3fbbc83db8651cc89287772d04c4c57b4f246948ce67e064a82e
SSDEEP 192:LJON96DphmqQmiUyxIq8wGYX59ezrCOsFkk7M7U6:lON9619hRwGYX5EiOsJiU6
TLSH
T112020A39ACB87CBB9DE76E45B44B36135FE9112FAA906F84D6E81A1C00D768C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00eb11d4-b3e5-4471-92c3-598c730ff599.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\00eb11d4-b3e5-4471-92c3-598c730ff599.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0a33004c1ff6ac8557e3f0f1302cb313b17e32a1460250247cbbbca106fdcd09
MD5 b24daf93d4737d05c9d690426bd8b25f
SHA1 cb3be2ec9e25ec5231fd6f81cbedca4a23e9fe99
SHA512 1826d07a3c702e9489f0b334357c884a02c185fef915005831eb4f1d7fbc584b755cab13fdc428ca46963ccd7c9daaf71d4649874eb17189802dd38ac784be8c
TLSH
T13441285CA6EE1108B3B76F5AAFF6A96D447FB8372E07D5AE10110D4F0662A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download