hxxps://b439950dc8b8f01189f56045bd003e34[.]108[.]us[.]prod[.]marketingusercontent[.]com/api/orgs/b439950d-c8b8-f011-89f5-6045bd003e34/r/bS7fvTMGZ0m1kDjfqDYAAAEAAAA?msdynmkt_target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fmy[.]brighthorizons[.]com%252F%253Finvitation%253DGnPYZpjfXWHdC690BsAmrsylfwf2u1Uu%2526organization%253Dorg_5O5Ba8v4Bzf1kIld%2526organization_name%253D2187%2526InvitationId%253Duinv_H4xy9PT4IBXIXFPR%2526InvitationType%253DOSR%22%2C%22RedirectOptions%22%3A%7B%221%22%3Anull%2C%222%22%3A%7B%22utm_medium%22%3A%22email%22%2C%22utm_term%22%3A%22N%2FA%22%2C%22utm_source%22%3A%22CIJ%22%2C%22utm_content%22%3A%22OSR_Welcome_a%22%2C%22utm_campaign%22%3A%22all_OSR-Enablement_2025-09%22%7D%7D%7D&msdynmkt_digest=AFUEsiYhPqX0j7XVox4SWNs9AxotvbZT1VTdpGHcmFQ%3D&msdynmkt_secretVersion=a3955a744d9049f88dd8bdc1907bf2bf

Analysis

user interaction
yes
max time kernel
34s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://b439950dc8b8f01189f56045bd003e34.108.us.prod.marketingusercontent.com/api/orgs/b439950d-c8b8-f011-89f5-6045bd003e34/r/bS7fvTMGZ0m1kDjfqDYAAAEAAAA?msdynmkt_target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fmy.brighthorizons.com%252F%253Finvitation%253DGnPYZpjfXWHdC690BsAmrsylfwf2u1Uu%2526organization%253Dorg_5O5Ba8v4Bzf1kIld%2526organization_name%253D2187%2526InvitationId%253Duinv_H4xy9PT4IBXIXFPR%2526InvitationType%253DOSR%22%2C%22RedirectOptions%22%3A%7B%221%22%3Anull%2C%222%22%3A%7B%22utm_medium%22%3A%22email%22%2C%22utm_term%22%3A%22N%2FA%22%2C%22utm_source%22%3A%22CIJ%22%2C%22utm_content%22%3A%22OSR_Welcome_a%22%2C%22utm_campaign%22%3A%22all_OSR-Enablement_2025-09%22%7D%7D%7D&msdynmkt_digest=AFUEsiYhPqX0j7XVox4SWNs9AxotvbZT1VTdpGHcmFQ%3D&msdynmkt_secretVersion=a3955a744d9049f88dd8bdc1907bf2bf
Sample261002-tfx33swdmb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4032	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{488680E1-EFDF-484C-86BC-BA70F2B20678}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 3884	4080	msedge.exe	85
PID 4080 wrote to memory of 4032	4080	msedge.exe	86
PID 4080 wrote to memory of 420	4080	msedge.exe	87
PID 4080 wrote to memory of 3928	4080	msedge.exe	88
PID 4080 wrote to memory of 420	4080	msedge.exe	87
PID 4080 wrote to memory of 420	4080	msedge.exe	87
PID 4080 wrote to memory of 3928	4080	msedge.exe	88
PID 4080 wrote to memory of 2492	4080	msedge.exe	89
PID 4080 wrote to memory of 2492	4080	msedge.exe	89
PID 4080 wrote to memory of 2492	4080	msedge.exe	89
PID 4080 wrote to memory of 2528	4080	msedge.exe	90
PID 4080 wrote to memory of 2528	4080	msedge.exe	90
PID 4080 wrote to memory of 2528	4080	msedge.exe	90
PID 4080 wrote to memory of 3704	4080	msedge.exe	92
PID 4080 wrote to memory of 740	4080	msedge.exe	93
PID 4080 wrote to memory of 3704	4080	msedge.exe	92
PID 4080 wrote to memory of 3704	4080	msedge.exe	92
PID 4080 wrote to memory of 740	4080	msedge.exe	93
PID 4080 wrote to memory of 740	4080	msedge.exe	93
PID 4080 wrote to memory of 2700	4080	msedge.exe	97
PID 4080 wrote to memory of 2700	4080	msedge.exe	97
PID 4080 wrote to memory of 2712	4080	msedge.exe	98
PID 4080 wrote to memory of 2712	4080	msedge.exe	98
PID 4080 wrote to memory of 4796	4080	msedge.exe	101
PID 4080 wrote to memory of 2816	4080	msedge.exe	103
PID 4080 wrote to memory of 2816	4080	msedge.exe	103
PID 4080 wrote to memory of 2816	4080	msedge.exe	103
PID 4080 wrote to memory of 1728	4080	msedge.exe	109
PID 4080 wrote to memory of 1728	4080	msedge.exe	109
PID 4080 wrote to memory of 1728	4080	msedge.exe	109
PID 4080 wrote to memory of 208	4080	msedge.exe	114
PID 4080 wrote to memory of 208	4080	msedge.exe	114
PID 4080 wrote to memory of 208	4080	msedge.exe	114
PID 4080 wrote to memory of 4432	4080	msedge.exe	115
PID 4080 wrote to memory of 4432	4080	msedge.exe	115
PID 4080 wrote to memory of 4432	4080	msedge.exe	115
PID 4080 wrote to memory of 2504	4080	msedge.exe	117
PID 4080 wrote to memory of 740	4080	msedge.exe	118
PID 4080 wrote to memory of 1240	4080	msedge.exe	119
PID 4080 wrote to memory of 1112	4080	msedge.exe	121
PID 4080 wrote to memory of 1112	4080	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://b439950dc8b8f01189f56045bd003e34.108.us.prod.marketingusercontent.com/api/orgs/b439950d-c8b8-f011-89f5-6045bd003e34/r/bS7fvTMGZ0m1kDjfqDYAAAEAAAA?msdynmkt_target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fmy.brighthorizons.com%252F%253Finvitation%253DGnPYZpjfXWHdC690BsAmrsylfwf2u1Uu%2526organization%253Dorg_5O5Ba8v4Bzf1kIld%2526organization_name%253D2187%2526InvitationId%253Duinv_H4xy9PT4IBXIXFPR%2526InvitationType%253DOSR%22%2C%22RedirectOptions%22%3A%7B%221%22%3Anull%2C%222%22%3A%7B%22utm_medium%22%3A%22email%22%2C%22utm_term%22%3A%22N%2FA%22%2C%22utm_source%22%3A%22CIJ%22%2C%22utm_content%22%3A%22OSR_Welcome_a%22%2C%22utm_campaign%22%3A%22all_OSR-Enablement_2025-09%22%7D%7D%7D&msdynmkt_digest=AFUEsiYhPqX0j7XVox4SWNs9AxotvbZT1VTdpGHcmFQ%3D&msdynmkt_secretVersion=a3955a744d9049f88dd8bdc1907bf2bf
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff6347c188,0x7fff6347c194,0x7fff6347c1a0
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,4672724949353407522,187521220324170846,524288 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,4652421110118081551,8172072272099806924,262144 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:2
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,8811851011943808134,2873577912792852601,524288 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,10838929798904008709,984275807611959147,2097152 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,16079195394954449304,514672648788720555,2097152 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,8644700034988589307,6798422523376154008,2097152 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4128,i,3901725077766971080,15490087697075026381,2097152 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,10437225107553165504,12728282073797431399,524288 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,5119569394520991682,769247750728951329,524288 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,12590515612314055042,475981284197414790,524288 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,12590515612314055042,475981284197414790,524288 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6200,i,18221010846360968502,11265967007383651003,2097152 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6356,i,1069071248176998643,2168481460657836765,2097152 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4296,i,16549809627335906086,9123009764785934063,2097152 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6288,i,17830494270952234808,623048483434735405,2097152 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,11630131104176205055,4283467851376911022,524288 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,3362290253733713532,1307664649425221288,524288 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,6189671875669896512,11136945482432187788,524288 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2748,i,2216953657574883254,14315075073748768500,524288 --field-trial-handle=2896,i,418188870886746670,16675869077501672798,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:8
  2⤵
  PID:1112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1281aec0-7f7a-4d27-8efa-7300e5544375.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1281aec0-7f7a-4d27-8efa-7300e5544375.tmp
Size 8KB
SHA256 4476865f6498eca9f8c86d5fd905064f912950dac9c64515cb58a98da55c3bb4
MD5 bde5992d0cbda2cc0657b4a53deb6564
SHA1 2247153dd1404c8c3fe3353dd7b37f652ce8dfe9
SHA512 187a2a63961b091b851d5604e99bd033fe9b05f8af89e8f7d3bbe81b7c7afda67da18d7549181f48009e32032b97827f6fb80e35c8ca2cec50208a87244ad3ee
SSDEEP 192:EONp6nnHGQmiUy7NQYcX5hQDP13OHo45oMcBiU6:EONp6nC+QNX5+Dt3OI45s0U6
TLSH
T1FA02DA34ADB87CBB8EF76D46B48737139F95216BE5842B84DAE81A1C01DB65C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a8f83e6-ef62-4dcb-b8bb-0ed3f000a31e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2a8f83e6-ef62-4dcb-b8bb-0ed3f000a31e.tmp
Size 18KB
SHA256 0a89d4e239f1b3b073a17ed9ed50e3273674c2213161c49e192e194872dd046e
MD5 6c790b678cf0fba7deb97d1f787faf87
SHA1 f1232366adaa588db0acd7336c53ee11c314cc47
SHA512 761950cbd10475a405773951594e7ba781c3c56741066fe1e902470c06f02f83ac418ac6e1d922cd1b59b58ad4ebdb5328ae327ce5336d961be5899995ba07b7
SSDEEP 384:TZcIhsNcUMPbi9RXQX5+Dt3OI45eU8JTGVZh6DKhHSZod:LhhOQkDlOI4oDJTGfYGHSZW
TLSH
T144828F32AC789C774EF6A586F44636439EB86163D6892FC0D1ECAB1C01DA6AC3317D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75614afa-d9aa-43c2-8dfd-b99762424c84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\75614afa-d9aa-43c2-8dfd-b99762424c84.tmp
Size 8KB
SHA256 ff10b9ae9f57a54baeb824a95bdd0067852007542665ec72664ae6863f964bd6
MD5 3b48df451052390c5feaf6a4237beef0
SHA1 241398774c2ffd65849c55288b002e2f581ec144
SHA512 5ef22aae04d67850155f782a1ae82c2e46f63a1cca09c5b1b4dafe4391bf8721bb0b1f4132272877e1e9c58e650425c8335ee66618663358c19b748691dc76ff
SSDEEP 192:EON+6nnHBQmiUyINlYcX5hQDP13OHo45ewFfEIg3Iq5GU6:EON+6n/3lNX5+Dt3OI45eU8zTGU6
TLSH
T10A121C31BCA8EC774EE26595B48736539EA51127DA897FC0D5EC2A1C01EF6AC230BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

2abfebf7-4de4-4e98-978e-c2a60cd23474.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2abfebf7-4de4-4e98-978e-c2a60cd23474.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91356273-6687-4ab6-94b4-d32067779887.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91356273-6687-4ab6-94b4-d32067779887.tmp
Size 10KB
SHA256 4670203a45f3de7762fd1885159baff0cd0a0b0fc73a27c7b2261ef720cc951a
MD5 dea0effad471648a11b73570d7bbe7f8
SHA1 91985ea87679d1ef28a6fe9fe38de4d3c31523d3
SHA512 bc77dc37cd25f5f0b734a64bb3eb951ab92918cfed502474cf64025fbea801f5588e111dc6325f237b487948dc483d3ceb127d4a62941d0068f50c038bf14ad2
SSDEEP 192:sxZQfRZWV/fws3iIdpAkEHW6+WNCDqtAn/YYBcm+hIgrJ:sxZaOV/fws3L0HbC++/fdS9
TLSH
T1CF22C7116E38657B8CCBE20ABB14BF53E6F9513195D11E58EAFCC61C05E6ADE230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 1d0b11608e2dd437d17bee906a49d36c8fd0a4fb2ad16fce27bbf02e1e00e1e4
MD5 07a14a8661b1d1a177e6ec5ca48791f5
SHA1 7cdbb1cec40ff200f3d5cf0ad133d5452792e211
SHA512 fc269ca2d03556e12e87a25726b3764b431601a2543f50264da668d69f04703a08ff0eaf8556683ba6f5defffe846c343098e30e2b83115c63daf2da12ffaaaa
TLSH
T1AAE020F506E8C23ED10D74470158574C8384769B93C06D1D1B00CB49BC4B4407393E62
MD5 SHA1 SHA512 TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 29KB
SHA256 8d1d33d6beea5a722b8f336d79c61c07405949457e37b5e65454c72dc10aba1a
MD5 50220d0057de0b9e5dc8b4fb36ee97a9
SHA1 4d0c1135f6767c3945e596c25abf69919ba4b646
SHA512 e305c7df33c9c99a62adc9637eac538520d846fdafffa738095667c8eb5326519564899211099ae4f39b63fb6d62f9366553861f101d797063447a61be8d1df4
SSDEEP 384:u8H1OIFdhnzrgxPfQPhTI67jde+X+7LEF15v/+cVur4KlRNME5BSwkR42VrSebai:3VOargxCRdpOW73Q/NMEqw8XrS8Bz
TLSH
T1F3D2F2784521EDDF2ECFF7167A43BD92208BE67B88F9268D92C5601B21360342C1DDE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
Size 204KB
SHA256 eff2498a14eb1bc3627a0c8ff5bb74f2526bc349c559f9cbb774cae163e46075
MD5 520c39568cf4e5c842fa84b5e9de3887
SHA1 16a9a57b0356592b4b428ebefec476d17b604ce5
SHA512 2eb7665716a1aa4bef1da676b9c2c0926ede73e9735ee04df92ecd24a6ffd3dfbd2a0214ffb71b961444076495afcf4f5f67dfe55f6b02d7724690e791052804
SSDEEP 6144:1+mRN29MgDZad/NVnyabtr4DN34kmMxqhv4aN:1rs3oZNVnzbti3wh5
TLSH
T11614226AFFAB0D16546E94CFAB47A9E3F2A10E409B77D3EDE5D4293400C8163589334E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 79KB
SHA256 e47a59090f4fbb1743e5279abc3bfbd178765d489abbc80cef1d3f5bb60a86be
MD5 dc43ee2824b35bc63286dfd32a405d12
SHA1 9547d9ffabd08a0d82bc07bba642ffafe81256e2
SHA512 a1fbb378657b77a450072144bd5b1bff7990987dd308bd52a867beec566397c7646cc85d21bcff0b9416d790b290f08caaddd9a2d12dfa6ecb28e228b62f0380
SSDEEP 1536:CjGZUZ5wRjUfPvNsx9Z8L3gG4BHRtq3xFafeEkHOIcOcGKdGui:CjGUz4UfPvNsKL3H4FRtQHREkvcBhji
TLSH
T110831292455BFF9DE3108E5CAEA6BB66E9324C6219D36F56E8537B40F0C4713338E048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 135KB
SHA256 54f270c8b71d024387d988dd11c6109f9bfa45dcb92e8b50ee7e9d483a4c3779
MD5 9119138b9bca4ea9829c0074a34d892c
SHA1 bb2022aaa0cce5b97120193283515842ad13d1af
SHA512 d6ba1f69e1b86568b23a38fcf700882103fcd1e1c7701bd0fa7d87d979fb7e80d761e9b7a769f2bf511e6a642fb7cc67afc1e1b113c479598f5283f8a0ae4990
SSDEEP 3072:5RJiz9F3pEVD0dMcln/Oe5eyvuiaztA3OiS0kIgOChIsC/F+9hwsd:tm1pg6X5eyvu35u1pY+/M9hw2
TLSH
T105D31227B4BF32DB2D4046EDF2AAD1D6CC1786836384849495C0BFD6729A039FA22F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 49KB
SHA256 d0b08eac7f09e31fb41c8ed6858d6d936d22ee72aaedb2abf5e59872d96c08f6
MD5 6d91c49c42ea48d9db39e4df8d3a1b4f
SHA1 6af8561cb90783a9653afba0bfbfb0bdca31615f
SHA512 5d9c9926950ee1be59aaec30d0d20847ac1c97669dde46466d59171629d003e8a8cc35aca3a7a060fc317cee2368ff196ae97bafdc05b1c72640dbd0aceb34b1
SSDEEP 1536:MzBzNTPXsUwrLdMXvYn3qQteXIllYduOkfNB/bKH:MnTPOGXvite4lmdanDA
TLSH
T14233F23DAFA04D0ECCC79F32BE772A44905331B314BB4B14BEA0DED2951E1A859C962C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6aa0eef4-7143-4f61-8f5a-bbf0a0fa92f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6aa0eef4-7143-4f61-8f5a-bbf0a0fa92f5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_bhloginsso.brighthorizons.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

337b665a-edca-4155-96e4-80ecb7219d2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\337b665a-edca-4155-96e4-80ecb7219d2d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ae17ab28-66e0-4fff-8eae-17b1b6606c0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ae17ab28-66e0-4fff-8eae-17b1b6606c0b.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f5ea83c6-fecb-4b3b-991e-37c174028385.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f5ea83c6-fecb-4b3b-991e-37c174028385.tmp
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

a2e15959-bb19-4027-b8b2-ffcc1bbd16f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a2e15959-bb19-4027-b8b2-ffcc1bbd16f4.tmp
Size 11KB
SHA256 dc3d06731ece6b48d89a2cc8307d83987b83368ca05fcf7ee3fb534439e8e558
MD5 95ea05354a9e35a0d200dd41f9053ffe
SHA1 c57ed5922a1e6e2aca049b13d2c0b71f4a7d1e87
SHA512 76d25910d651de0b0b9e2d92097b98ebd012aa56a56017a7cc4679a99b612d5bac6abbe4c4f643e20cf43978ae2b2c95a35d60a9aaed53d575ac75a3822acc13
SSDEEP 192:sxZQYRZWV/fwsS5IdpwndEHW6+WNCD8NtAn/YYBcm+hIg5fJ:sxZJOV/fwsSStHbCi+/fdSv
TLSH
T14232C6126E34697B8CCBD21ABA14BF53E2F9613195D11E58AAFCC61C05E67DD330780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8f75e53-ddd2-4e16-9652-2c445b6521e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8f75e53-ddd2-4e16-9652-2c445b6521e3.tmp
Size 27KB
SHA256 e89063e2572a18a8bffca45769cf5dc37dec21546203d1275896bc3dcd5c9daa
MD5 535aeb57075081626d5d610b8907fe25
SHA1 960a914fc86a62b76eddced9bba6f29359c89b81
SHA512 792db6fac5c877b3600c9b489c70ca176c9a69eb4b9e5c2760926a0eba4a24aac0fbaf4675c31e22fd8cfadbf3efc35798c528ddd5ec8040ceb5bb634f1e32af
SSDEEP 768:AxyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXjropnmEu:AxyYR7jWv3NpBu1ja/CL8OXQs
TLSH
T193C2E93F640DCB7E4FC01A9DDC5A6F9B6E9802C7A6548D4047FA944C02C77EAA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 54d1767616f7fedc6e2af7d47611c42a940c9511ecaac83b3762579ee6dc18b7
MD5 b98e3bf775fead2612ce6b729c6b08f5
SHA1 be9e4fa026e3683d3500c5f74aede30834abc432
SHA512 736c52dc529932b787465c6714fcbf9c641561f84ce17aa8f638f8b1694ba0d0d6a8b102989d4976a2e563c5af156bba79bc7c8c8d0468d1d15fbae56e1b4d16
TLSH
T11F41F84DAAEA1144B3736E5AAFF7B86D447FB9772F46945E10110D4F0A22B40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads