hxxps://f16aa01f[.]click[.]kit-mail3[.]com/n4unqlxqqwhvhxd354nt6h66g273mflhmxkox/48hvhehm7xz535hxh7/aHR0cHM6Ly93ZXh1cGRhdGVzLmNvbS8=

Analysis

user interaction
yes
max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/10/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://f16aa01f.click.kit-mail3.com/n4unqlxqqwhvhxd354nt6h66g273mflhmxkox/48hvhehm7xz535hxh7/aHR0cHM6Ly93ZXh1cGRhdGVzLmNvbS8=
Sample261015-vrabtsdd95

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
564	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{93B4EE75-545E-45C4-AAA1-245E5D937C0A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2728	2280	msedge.exe	89
PID 2280 wrote to memory of 564	2280	msedge.exe	90
PID 2280 wrote to memory of 3024	2280	msedge.exe	91
PID 2280 wrote to memory of 3024	2280	msedge.exe	91
PID 2280 wrote to memory of 3024	2280	msedge.exe	91
PID 2280 wrote to memory of 32	2280	msedge.exe	92
PID 2280 wrote to memory of 32	2280	msedge.exe	92
PID 2280 wrote to memory of 4808	2280	msedge.exe	93
PID 2280 wrote to memory of 4808	2280	msedge.exe	93
PID 2280 wrote to memory of 4808	2280	msedge.exe	93
PID 2280 wrote to memory of 2412	2280	msedge.exe	94
PID 2280 wrote to memory of 2412	2280	msedge.exe	94
PID 2280 wrote to memory of 2412	2280	msedge.exe	94
PID 2280 wrote to memory of 3856	2280	msedge.exe	95
PID 2280 wrote to memory of 4104	2280	msedge.exe	96
PID 2280 wrote to memory of 3856	2280	msedge.exe	95
PID 2280 wrote to memory of 3856	2280	msedge.exe	95
PID 2280 wrote to memory of 4104	2280	msedge.exe	96
PID 2280 wrote to memory of 4104	2280	msedge.exe	96
PID 2280 wrote to memory of 4280	2280	msedge.exe	99
PID 2280 wrote to memory of 4280	2280	msedge.exe	99
PID 2280 wrote to memory of 4280	2280	msedge.exe	99
PID 2280 wrote to memory of 3936	2280	msedge.exe	102
PID 2280 wrote to memory of 3936	2280	msedge.exe	102
PID 2280 wrote to memory of 3936	2280	msedge.exe	102
PID 2280 wrote to memory of 2304	2280	msedge.exe	103
PID 2280 wrote to memory of 3660	2280	msedge.exe	104
PID 2280 wrote to memory of 2304	2280	msedge.exe	103
PID 2280 wrote to memory of 3660	2280	msedge.exe	104
PID 2280 wrote to memory of 4576	2280	msedge.exe	106
PID 2280 wrote to memory of 1668	2280	msedge.exe	113
PID 2280 wrote to memory of 1668	2280	msedge.exe	113
PID 2280 wrote to memory of 1668	2280	msedge.exe	113
PID 2280 wrote to memory of 1184	2280	msedge.exe	117
PID 2280 wrote to memory of 5064	2280	msedge.exe	118
PID 2280 wrote to memory of 4136	2280	msedge.exe	119
PID 2280 wrote to memory of 1680	2280	msedge.exe	122
PID 2280 wrote to memory of 1680	2280	msedge.exe	122
PID 2280 wrote to memory of 1680	2280	msedge.exe	122
PID 2280 wrote to memory of 396	2280	msedge.exe	128
PID 2280 wrote to memory of 396	2280	msedge.exe	128
PID 2280 wrote to memory of 4756	2280	msedge.exe	131
PID 2280 wrote to memory of 4756	2280	msedge.exe	131
PID 2280 wrote to memory of 4756	2280	msedge.exe	131
PID 2280 wrote to memory of 1240	2280	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://f16aa01f.click.kit-mail3.com/n4unqlxqqwhvhxd354nt6h66g273mflhmxkox/48hvhehm7xz535hxh7/aHR0cHM6Ly93ZXh1cGRhdGVzLmNvbS8=
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffeec68c188,0x7ffeec68c194,0x7ffeec68c1a0
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,6728233325807074457,8066501805002289194,524288 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:3
  2⤵
  - System Time Discovery
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,4312697576849799665,11381841022511851188,262144 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,16155874138720836265,16179003318752292101,524288 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,11968705958135061604,3628174274742424663,2097152 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,8288043996687548608,3018293004854186641,2097152 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,4181640512807612026,13154663643749017140,2097152 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,12771229118188881930,13908906932620426975,2097152 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3612,i,15347160295139005604,1046568778333519429,2097152 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3476,i,10868667973871979450,4203369596031272826,2097152 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,5644123060265960867,9081735419730619827,524288 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,17288832935437292986,7361848015474241359,524288 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,11985196182629281684,8557767336764532633,524288 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,11985196182629281684,8557767336764532633,524288 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6212,i,7942157526792536561,618822294534565822,2097152 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,12954288478682020943,6442406455514422003,524288 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,7707510655516166939,9130300843410849624,524288 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,5345027205574426127,16377717694847852353,524288 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6360,i,8676299158381132959,5349527828779549223,2097152 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,15467737428800747937,4492057247797827718,524288 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=780,i,11933633304726081311,1039495667118440826,2097152 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5516,i,12494167655183707116,14130466974517558845,262144 --field-trial-handle=1988,i,10266093654446226575,5423361529347809145,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0f40cbbf-2b81-4f42-8e00-e8df0cb209b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0f40cbbf-2b81-4f42-8e00-e8df0cb209b0.tmp
Size 18KB
SHA256 f1b60b8f6be7756b4d6398f09a58d02044cce7641d06363e6a08a3d52096cec6
MD5 8ffd3d84dda674a686fd466c4ce7b22d
SHA1 32fbc4bb6d414873af3a1fdac421d057d1a58d8b
SHA512 b613e845d5604265854af4f480cc0547bc041b4333af63c2993355d92f598d0a14854bc3aad89d4c01fa4bd51bab9e8b87bea6c61bb3d26adc69b560dfe43701
SSDEEP 384:2QkUSv0sN/UxZipuZ+Ia9iX5Fg1+8VIIl1:W0HiKea0+8VLn
TLSH
T11D827E356878AD3F8AD39611F18E35439FB4912BDAC92F68C9DD6B2C01DA1D8170B932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4baf5bf4-a56d-4d96-845a-7f2dc7c02cdb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4baf5bf4-a56d-4d96-845a-7f2dc7c02cdb.tmp
Size 8KB
SHA256 61a1a7c2cdc72bc2397047d33536133d29aa5bfc322521df63da14cfcea7fca9
MD5 dcf2272925275fef320b5429c4a0210d
SHA1 408fe56dcf13240e0df3ec723391d7abca45d556
SHA512 b2e7af268fa1aeeba8bd85b7e3f89db9e65aac923a929ded00538e8d975a4b445abb447f32c3b63b0b06ecd9e29efb27ea00ab0bee4a26afac49286322172f57
SSDEEP 192:MONt6AmwpgQmiUyOHt7GsiX5F1RY36DlRGqCU6:MONt6ipg11GsiX5FgY+U6
TLSH
T1BC121C36B4B8AC7F4DD2A550F48B35135EB5412BEB897F95C9EC2B2C01DF198470A832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6be86ff9-65c4-4857-bcf1-19919fccb44d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6be86ff9-65c4-4857-bcf1-19919fccb44d.tmp
Size 18KB
SHA256 9dfaeb37a025687ba4cc43377cb09a417d05cb220d7912dd50a409ca59b2c5d2
MD5 e1379adea72879b764ff6dea873d4325
SHA1 96dd60dc74dc3b38b7c98b0b9b1ec1ea7e1e5dd0
SHA512 b8a70b498ac7bed120d62c7401a9e836921582948caf36f06726a11773dad9d0b5811326b39517354a8cba8fa2bb355eb8aa55fdb2bd83d6f8301a17d1944bc6
SSDEEP 384:XQkUSv0sN/UYZipuZ+Ia9iX5Fg1+8VIIl1:p0oiKea0+8VLn
TLSH
T1BC827E356878AD3F8AD3D611F18E35439FB4912BDAC92F68C9DD6B2C01DA1D8170B932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86ab63a3-3ade-4226-80af-f44ccb3c82ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\86ab63a3-3ade-4226-80af-f44ccb3c82ab.tmp
Size 21KB
SHA256 1e88502feaeafa441b90bb41d1a06490580d1e1433171340a380e314a823e55e
MD5 8bddd91f893b15631a65cf9cb93a89c6
SHA1 76ea8cd514e81b255def72f747ae36c7b49e658f
SHA512 7656bd2dae599feb380078a3100f2eac943bb0de8121097af26b56291732a8994af60eef7826569b7277cac577ec9355b0ddcc9062527bb28bacffe8e5d6ad4f
SSDEEP 384:qiFzQkUSv3zsN08TUNTUlIlYZipuZ+Ia9iX5Fgw+8VIIl1:hFdjJwg2iKeaf+8VLn
TLSH
T1C3A26C3258A4DD3F9EE29B01F14E32039FB4916BDA85AF65DACD6A1C01DA1CC130BD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

2abd6ca3-5fd8-4c2c-962a-aced64e1c5db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2abd6ca3-5fd8-4c2c-962a-aced64e1c5db.tmp
Size 27KB
SHA256 4ce4ac3fe917601432f4668f94cbbf234a3a56f6b8bbf3bb29db719524ed7e60
MD5 5dfe2e4f0f54a6414e90dbe50980cb44
SHA1 aba1597e61351fb0c17d44a7cb16063aaf185d09
SHA512 3948e68ad110a4ff9a7c74c474f7b16f934f1a79320e5e5ac564725adeded5e814cce3eb14de7e5a1471bfdfa4f4f8b64787ae79b481a83804e1133f883d50f9
SSDEEP 768:aq30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ725rolZM1:aq30AbSWvS2l9u1jaLmLZ12yu
TLSH
T114C2DA3B640CCB7E4FC05A9DDC6AAF9A6E9802C796648D4047FA984C02C77EA51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3adc8581-5c1e-476e-a80a-ec4b3a401c60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3adc8581-5c1e-476e-a80a-ec4b3a401c60.tmp
Size 10KB
SHA256 f4b2fe308d58e84020a6451acd6586088171e6e62bc3f32b2c11eca2b26eeca6
MD5 5ba95dd00ff7471c4f26be27c4fa266d
SHA1 926aa954d13e6c2a90ef2dd75323f4b6128a8f19
SHA512 8973c2c8907b4166cd00ea4b022ef71a2ebc8bd12fc69bd2c4a6ed0c04c98c2e2aeb5b63fd95ea10014d436cba906166ff76132272947fb988af063b9837b00e
SSDEEP 192:sxZaRqWJ/frsQuIdpICHW6+WNGY34qb+bIg5HJ:sxZaTJ/frsQ//HbGoUf
TLSH
T15922D8126E38697B8CC7D20DBA59BF53E6F95032A1901E48A6FCD91C05E7ADE120781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 2c774ddb8f711e525b6831840407e4d66f8a278f32e46d96ed6b63c7b0aae842
MD5 e2e23bac09fa1f0666ed56e5d1a74d36
SHA1 6d5f6ce2292df088fcde11143110520a17d24ffd
SHA512 f7c7f532cf223bad2393c4ffd09ac40c7e3f5947eb6efe565e55e7348aadb581d7ec90a23d5b06ce0c5c5fe7b79287f224fa1435eb02b361dd6ff2955653b052
TLSH
T1CE615C8599B00090FBFB49F395E1F48337F09A93AFB72DB1DB58C0788A0E350A316084
MD5 SHA1 SHA512 TLSH

Submit Download

db1682c5-3139-4542-b4ef-5e3b16861767.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\db1682c5-3139-4542-b4ef-5e3b16861767.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3558dd04-0aea-42ec-81bc-b551f9907c09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3558dd04-0aea-42ec-81bc-b551f9907c09.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

5977e8e2-58ad-4fe3-8d92-74cbb35a402f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5977e8e2-58ad-4fe3-8d92-74cbb35a402f.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

93ff43de-7354-4f54-932f-00fcde3b9f87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\93ff43de-7354-4f54-932f-00fcde3b9f87.tmp
Size 1KB
SHA256 bc290a69e315bd02a076b28b0191f0588b18352b6c310eaf2e01f94d33b254e0
MD5 0b3decc233a832de30aba10613fc279b
SHA1 72bc0d91957a380060a4063b79e1f49261ddaed8
SHA512 f87615b946c5e4591f05674d542cec847c134c96dd75bebbcc1ff9706bffbe8182e5e7cfbf4e614b04ba87a4bbdb4e49d6925bcf97a54584a6c8b0a74f750c49
TLSH
T18E116DF387E5956E8A1116F05A14EE2BCE2C0616831C7C1A85D4EF67D3E34B5E00195B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 29bdd50c2df8e9422a49a0c16b0e2a10b8c9137e96aa7143e6bf3ec4fd4253da
MD5 676db79cd984d1a8f1790dea46538cb6
SHA1 d724da305c19d9f32f1199ba33f6fa69d3a2636d
SHA512 207a0e9c68c0bb109cd368c7e9a98e0bfd79038d31a1cbc5440b664ec930a38324fc0219b111794b275e65d3cde7685dc67b51a8947e7b5b34ffe8057dddca4b
SSDEEP 96:Kg/mKskqS0IKZemfmj/tNdS7lshxPSKpXxpSlPXUh/b2X+bXl:A1jaXT
TLSH
T115913D1170AB134638FD294A40A9D71A465231F33018E93EBFAD41E24AAFE141EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a518cf47-a1a2-42e1-a98b-a567f4ed14eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a518cf47-a1a2-42e1-a98b-a567f4ed14eb.tmp
Size 10KB
SHA256 aff4accf61969cde06c6283b2e880816314bb7da72e058a5eefbb1ca1c70c61b
MD5 eaecd75401bfb09f512b62873df71054
SHA1 2674ccca1910c19eecf38960b50fc3abaf085df5
SHA512 446b2a6017c1945ab203c89608a62c9e868ce1f76a8ebfeba214cc3337c5bdb6e0503899d15e95020c33b2311716a9d772028101d858da0b831b365c6f78a483
SSDEEP 192:sxZaRqWJ/frsQuIdp6CHW6+WNGY3mNY+bIg5HJ:sxZaTJ/frsQ/JHbGoUf
TLSH
T10C22C8126E38697B8CC7D20DBA59BF53E6F95032A1941E48E6FC9A1C05E76CE120781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0465346-d0f1-41e3-bf11-7b3807c88df5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0465346-d0f1-41e3-bf11-7b3807c88df5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc4db49b-7f33-4fad-b780-cb781e0a14ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc4db49b-7f33-4fad-b780-cb781e0a14ce.tmp
Size 10KB
SHA256 3d0d46ce1a27b4320e9e6c738b1db0d3d751f51576d989aaeab2493751b1d297
MD5 0657cf226177711128bf9322e875b288
SHA1 b268520b35175b1b2ee85805594b41f2e67bf733
SHA512 c95c3714712833703b052602a0115d1760672ef8f4bc61a81df2fbf0bdee7cbedf36622ee2f0a1e9e2eef4a56ed00c2645b69871bb8bcc0a3833bee75430ff94
SSDEEP 192:sxZaRqWJ/frseuIdp6CHW6+WNGY3SlY+bIg5tJ:sxZaTJ/frse/JHbG8UJ
TLSH
T15B22D8126E38693B8CC7D20DBA59BF53E6F95032A1D41E48EAFC991C05E76DE120781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0a9badf-c4f8-4411-829c-9e5e0c251abf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0a9badf-c4f8-4411-829c-9e5e0c251abf.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

faccc4e5-d166-41eb-99f4-47d7dd5e4bd1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\faccc4e5-d166-41eb-99f4-47d7dd5e4bd1.tmp
Size 9KB
SHA256 585be6426403b6ad529a3864a0c2d41e053ed915440a0939296de3c3fa49d570
MD5 aeccbbb632956d7c74d9621ee13e4a6a
SHA1 85691bd00418a03d09f46bd84ae9e3634cc66f63
SHA512 8b4890077c9a269f401332fe5c1f4c8b29fbb561cb1243e1fab89647cc720c6ddc83177c90b1bd04d3f3f47e047080cf7c288a66e7641e385246e67882dca385
SSDEEP 192:sxZaRqWJ/frs3uIdp6CHW6+WNGY3SlY+bIgrJ:sxZaTJ/frs3/JHbG8U9
TLSH
T16C22D9126E38693B8CC7D20DBA69BF53E6F95032A1D41E48EAFC951C05E76DE120781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

368732a3-7b49-436e-9d90-17f415c57b83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\368732a3-7b49-436e-9d90-17f415c57b83.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c72153d6-f943-4924-8d9d-b8bef6b0bae5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c72153d6-f943-4924-8d9d-b8bef6b0bae5.tmp
Size 8KB
SHA256 7d2ba908005d5cc4282158ced98bdbfafa9515d3a2e99bf3a42eb1eedce11b57
MD5 0990996422b4726b3baf0b024953fa9e
SHA1 e7e6079f199fe55203fb158cdf35e32595551653
SHA512 7f2f2aef514429c907e3405e4df3a7fabf2001c2d7d73c9c780ffb39b7ed942817927b9287860889931558e0c44b46bd5ad154d82be82c168b7cf77b089462cd
SSDEEP 192:LONP6AmwprQmiUyLt76siX5F1RgJirCU6:LONP6ipdy6siX5FNWU6
TLSH
T169020B35AC686C7F8DE3AE15B58B37136FA5116BDA952F44CAE81B2C01D768C1307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

641fc25d-db4e-4638-89c0-e69381301bf2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\641fc25d-db4e-4638-89c0-e69381301bf2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a8d35739825ea69a89744bdecb4c9606a0fb5cafba7dd09ca7718f2ae57cc9e1
MD5 84346008803c5855cb41e6e87b415f8e
SHA1 9541408d263431504f51e933a915d4c77e1b5cff
SHA512 bcbf72b12dfa03229cd04c7776663166c03b8e0cbed19dc30f139d9e885592c0ed274922c9eb11ffb1fb3a712d894180457a8a4db208d7da638877b0607091a4
TLSH
T19E412B5DA6F91144B3B76E169BF7A87E887B7D772E0AD46E10010D4F4623A40CCA2737
MD5 SHA1 SHA512 TLSH

Submit Download