hxxp://mailto[:]spamproc-p04@us[.]fbl[.]en25[.]com/?subject=ListUnsub_1260946616_2839a392974b4d488465d6d9c81ebe20

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mailto:[email protected]/?subject=ListUnsub_1260946616_2839a392974b4d488465d6d9c81ebe20
Sample261027-spr3ravvcx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4188	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{012B2296-473E-4B5F-8CF6-D39B0EA99BBF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
840	msedge.exe
840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 2852	924	msedge.exe	86
PID 924 wrote to memory of 4188	924	msedge.exe	87
PID 924 wrote to memory of 5020	924	msedge.exe	88
PID 924 wrote to memory of 5020	924	msedge.exe	88
PID 924 wrote to memory of 5020	924	msedge.exe	88
PID 924 wrote to memory of 1388	924	msedge.exe	89
PID 924 wrote to memory of 1388	924	msedge.exe	89
PID 924 wrote to memory of 4540	924	msedge.exe	91
PID 924 wrote to memory of 4540	924	msedge.exe	91
PID 924 wrote to memory of 4540	924	msedge.exe	91
PID 924 wrote to memory of 4300	924	msedge.exe	92
PID 924 wrote to memory of 4300	924	msedge.exe	92
PID 924 wrote to memory of 4300	924	msedge.exe	92
PID 924 wrote to memory of 2760	924	msedge.exe	93
PID 924 wrote to memory of 3784	924	msedge.exe	94
PID 924 wrote to memory of 2760	924	msedge.exe	93
PID 924 wrote to memory of 2760	924	msedge.exe	93
PID 924 wrote to memory of 3784	924	msedge.exe	94
PID 924 wrote to memory of 3784	924	msedge.exe	94
PID 924 wrote to memory of 3728	924	msedge.exe	97
PID 924 wrote to memory of 3728	924	msedge.exe	97
PID 924 wrote to memory of 3728	924	msedge.exe	97
PID 924 wrote to memory of 3200	924	msedge.exe	99
PID 924 wrote to memory of 3200	924	msedge.exe	99
PID 924 wrote to memory of 3200	924	msedge.exe	99
PID 924 wrote to memory of 1904	924	msedge.exe	100
PID 924 wrote to memory of 1904	924	msedge.exe	100
PID 924 wrote to memory of 2120	924	msedge.exe	101
PID 924 wrote to memory of 2120	924	msedge.exe	101
PID 924 wrote to memory of 4780	924	msedge.exe	103
PID 924 wrote to memory of 1228	924	msedge.exe	108
PID 924 wrote to memory of 1228	924	msedge.exe	108
PID 924 wrote to memory of 1228	924	msedge.exe	108
PID 924 wrote to memory of 3108	924	msedge.exe	113
PID 924 wrote to memory of 3244	924	msedge.exe	114
PID 924 wrote to memory of 4004	924	msedge.exe	115
PID 924 wrote to memory of 772	924	msedge.exe	117
PID 924 wrote to memory of 772	924	msedge.exe	117
PID 924 wrote to memory of 772	924	msedge.exe	117
PID 924 wrote to memory of 2660	924	msedge.exe	118
PID 924 wrote to memory of 2660	924	msedge.exe	118
PID 924 wrote to memory of 1048	924	msedge.exe	119
PID 924 wrote to memory of 1048	924	msedge.exe	119
PID 924 wrote to memory of 5028	924	msedge.exe	120
PID 924 wrote to memory of 5028	924	msedge.exe	120
PID 924 wrote to memory of 5028	924	msedge.exe	120
PID 924 wrote to memory of 840	924	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mailto:[email protected]/?subject=ListUnsub_1260946616_2839a392974b4d488465d6d9c81ebe20
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ff872abc188,0x7ff872abc194,0x7ff872abc1a0
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,3366551328506996436,14530869512267599835,524288 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,16583998278646428247,10311449776886084620,262144 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,8088614358381637907,4475884664606471680,524288 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,17548538130792017681,16255117144119561116,2097152 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,6473219179036481419,9560439225454295858,2097152 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,4348944229855533299,4815900873368869285,2097152 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=1648 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,3618411278239513511,9147820645989674438,2097152 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3572,i,11654951305892761858,14444466675731614494,2097152 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5240,i,10451531582176473334,16192171988717954333,2097152 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,5621682357193790846,4462460413617706121,524288 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,4450772275050943303,8149826024772793402,524288 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,12523249423744402567,6538862262896000641,524288 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,12523249423744402567,6538862262896000641,524288 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6232,i,13093165920500030626,12899098723585921026,2097152 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,14907231638854267794,8481860793420514355,524288 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,7225956864394630293,15855511098123071441,524288 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,8419974606168145118,7945375152697695157,524288 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2812,i,4983628873220277291,10075261761678573461,2097152 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,7226527599027999851,16448402317660819629,524288 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,14916335513434323074,2579000027077387241,524288 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5744,i,5021389296502486486,5252817951718373515,2097152 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5764,i,1861371932062650839,16838038693591528579,262144 --field-trial-handle=2348,i,9254245400884497405,2571694424910002701,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0ad519ef-74c7-4727-88e7-b6b7d7be70a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0ad519ef-74c7-4727-88e7-b6b7d7be70a4.tmp
Size 18KB
SHA256 ae425f1f546a01e6843e8a2fbc21aea5a064578f6651252cb56a4f165e0b022f
MD5 f89df1f424e7573978adcd4f940c2e39
SHA1 41bfa8a6ac5569075dbcb189550cfd64370059b1
SHA512 702b23aa5b493016378980d74ef62b8a6fe43b8f7df1a117dcff1898a8a67702dfd5d11e8977138f258a852680f729b0ead9b34d4cfc91de1396aff23efb5092
SSDEEP 384:dQkUSv0sNsUlPoA/bT8Yh//z8ExUXQ1VvaTZcSu+qIIl3l:H0fk/D8Q1VvaTZcSCLD
TLSH
T113826D357869AC374EE7A1A0B04B3613DFB08167DBD41F90DADD9B2D01DA29C2347D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22628c7c-cfb7-4d62-812f-6391e4009ac5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\22628c7c-cfb7-4d62-812f-6391e4009ac5.tmp
Size 8KB
SHA256 565479971cae1acecde8f23caabf557a75c1c292105620befef5871e7563528b
MD5 0ad09ac096509d6cc3f8c56c4cae9a75
SHA1 b68aa7ea7761539697bd29c7aaf2e38c99a5a007
SHA512 92235e8a2f0e430c6ba3a55aaf21b1e802a4df2ffabe89decd87cfa1feaeeea6d06f4910307e160d7a1940e17db925e63a765a3215e1f5740db2a27a95563ece
SSDEEP 192:BONN6JUm0QmiUyspso//jjzorB6ywxWjBCraU6:BONN6+mEdso//z8ExHWU6
TLSH
T14E02C838BC287C7B9EF3AE45B44737139FA5107BA6951F80DAE85E2D01D725C2306D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

09df46bf-1317-4f7b-9a6c-8a4de5dba4c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\09df46bf-1317-4f7b-9a6c-8a4de5dba4c9.tmp
Size 10KB
SHA256 4d847cefe289c30321a220894736f39b8d22f08f195f3049ba01cc3bba1d0a1e
MD5 a52a93a0169f2b46268f7535be28d0db
SHA1 cc4d2a916c5c2588a942933b3fa07b3b196a39ba
SHA512 a12d90ac4a374ffd112f1443634474c109ca7ca6ee6661680faf416224e23e7d65dc2d64a322d2d405cf416adf5ade96660d3d2ab67d509f15ce54bc66fce0e7
SSDEEP 192:sxZdRsWP/f8svHIdpLoHZ36+WNGY36tu7+BaIg5IJ:sxZd9P/f8svIEHeGXkPi
TLSH
T1DB22C8517E28697B8CCBE21DBA55BF13E6F9503291D51E88E6FC8A1C05E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4431ab48-bd0f-4e51-8803-f25622cd2ad5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4431ab48-bd0f-4e51-8803-f25622cd2ad5.tmp
Size 10KB
SHA256 3da3fa7fbdff33321d1b737add425f364f535c21f3781c210ce1a2a81891bb2f
MD5 c529b86bd78c23f963480138fb7c9180
SHA1 2d6b14a7b584fb726f057cde9bf17b19bd272d60
SHA512 0b13458fe14c90f22b25c7bde251629b823cec0543e79ac5ee483e4276eb66c9c523d8e28fa09d536212a6c3926759cc29037bca6c6abfe0e5169dc2b9da363d
SSDEEP 192:sxZdRsWP/f8svHIdp5oHZ36+WNDvo/Y366x7+BaIg5IJ:sxZd9P/f8svISHe8/X0Pi
TLSH
T18F22D8527E28797B8CCBE21DBA55BF13E6F9503191D51E88E6FC8A1C05E6ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5188db28-338b-4b0f-b6e9-2b9fdeb0b3bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5188db28-338b-4b0f-b6e9-2b9fdeb0b3bd.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77c404ea-2b2d-42f2-ae07-29b14cb5c428.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\77c404ea-2b2d-42f2-ae07-29b14cb5c428.tmp
Size 27KB
SHA256 cc20694badd466b59aed05dad041105aba4b185f1b2642877d20a0d6cc9d3eab
MD5 b30f4026ff8980ed8354c1a5826b73b1
SHA1 0aad77187e034d7f62b23bbe584e3244f8f58318
SHA512 319e7fb66855d9602ee5a19bf69846b8e7479dc58099bf48d4adf773fbc3a35586f888943f85fca1ba640135f2ed44aea1cb6c40a7809896dca14620fc842c05
SSDEEP 768:B1Klm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/irocT:B1Klm7QWvUYe0u1ja8/L/E/5cT
TLSH
T1E9C2FA3B740CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 bb8cbd853bfa9f43ee1c189e7ae0329d04b168d064c20eba1ff9e914668aea89
MD5 445dd2625b217cdc139bc55dcb2ef219
SHA1 f4510db320b2b76d8b3fcbf84735151075fb76bc
SHA512 9c8f2574acb7755c7ffe60319719ca89fc91d398fec4f1f88832277252e6e4073d1d5f4b0af8557b1ec956c95e850ba76641d06c9e17db255ea1e3c5c424decd
TLSH
T181E0269705C8C22FB64A644B02ACE74C93A22B6F92C07B0E1708C6897207584A3C7AD8
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 e7556b7ee09e65668d4c2d84f94b208f0a0ee0749b0125c24e76e8b938e55f55
MD5 998f3b60b030cad723596eafe6dada18
SHA1 af90a61f10385f64cf81191ee36ce311bd7b1a8e
SHA512 41d9fcba5f5150f35859c20ccf06cdba5c574bb38e2038525aa126a79f7cbb62caa072f943d410db7cc3b927ef0caa5d15e72f621601c8b6c63c96f25786b666
TLSH
T1B4618F90BFD078A1FBA87FB9DFD7048336B3A7C01AA7ED40A080D8F95E067905060354
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a4e6252d7df75aad843148bd50aefd19471729930170f2be96d512c7cec8d615
MD5 396afbc3953825ed7eb240d700eaa633
SHA1 a60a74136d690b45504209f1ab39b25315d832c2
SHA512 854666c69e3eb5b57381c907bc075317be2f422802b54faa104632b824adcc38770e5b78bc6affab920b8766fa8eeb78e44b6f88ef1bf422c2b1eba2da019eb6
TLSH
T112618050BFC078A1FBA87FB9DFD7048336B3A7C01AA7ED41A080D8F95E067905060354
MD5 SHA1 SHA512 TLSH

Submit Download

c79cd0c5-fc50-4b43-9ccb-6f75eed45813.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c79cd0c5-fc50-4b43-9ccb-6f75eed45813.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0d6831eb-1f70-4bbf-acca-0cbf544fe399.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0d6831eb-1f70-4bbf-acca-0cbf544fe399.tmp
Size 949B
SHA256 07daf4c270b59bfaf1c361958c9ef752bdebabec6048e12c0932d1d539121915
MD5 9b1692000d97ffaa3d5ce368c6e2a5c4
SHA1 2e5febf5e911c5c14d23ec622091cfb7e77fc71c
SHA512 dd0bcdf0aee032e7d979baaeb8e1cc5b33b06c297bd6b5d05ec98682f8300d623d7fa589043b890edfbb4b62ca23ce4f1f7da0f472356b7998a52011acb9d0df
TLSH
T199117DF3C7D5956E890556F05A24AE2BCE2D0505821C7C15C9D4EF2B93E3475E00155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dd703c52-e683-4317-9411-68606e4967cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dd703c52-e683-4317-9411-68606e4967cd.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e5c5f418-1241-4deb-81b1-2bf6b3a404e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e5c5f418-1241-4deb-81b1-2bf6b3a404e8.tmp
Size 9KB
SHA256 46248dad0049bd5919820d439fd52761c51e4e263d05ca97777f3d0512d7ada2
MD5 b5000a48b4a262abec1425579a8ca329
SHA1 56b70b4cd3a3fed0c82041a669870d37d3b7a792
SHA512 a08849af416c1d9cc9cd316d575b9eb55d1950f765e0e96be2ca6b53c4f600d9d8d334bc24f17663e91557dfec989ddb5818f50018a97203e1b1190a9f8d1d45
SSDEEP 192:sxZdRsWP/f8saHIdpLoHZX6+WNGY36WM7+BaIg5iJ:sxZd9P/f8saIEH2GXHP4
TLSH
T1BB22C6527F28697B8CCBE21DBA25BF03D6F9503191D51E88E6FC8A1C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8a2a2e0-077c-40ba-a359-b3632309c561.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e8a2a2e0-077c-40ba-a359-b3632309c561.tmp
Size 9KB
SHA256 b8373e99bc8e3cbfd2ad0cf47a8ccf6accc9c359c943e9155fec897387c7bb71
MD5 a67394ebd3f6450caa1c4c30854fc1d9
SHA1 b0d3ed99883939d00f40e22e830b1d655394df2d
SHA512 3db4fb2f5d3ed91a7951b1856e3350072d79444b2a29dc3584e7f94ae0816ab0daf4da62d828557a4acff2b6251e5825298488a12eaf3e51c0791b9a9e24fbcd
SSDEEP 192:sxZdRsWP/f8sdHIdpLoHZX6+WNGY36WM7+BaIgrJ:sxZd9P/f8sdIEH2GXHP9
TLSH
T1E322B7527F28697B8CCBD21DBA25BF13D6F9503191D51E88E6FC861C05E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17001093-bb34-476d-8951-d8fc06a11c29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\17001093-bb34-476d-8951-d8fc06a11c29.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 65d0eb93f088412e42a72643e38fa63d4b8112e994fdbe901512a4270859aea6
MD5 9e43ba5b3dfc95ac4ecc5275da68eadf
SHA1 4846bd3beadc126abf7d7b59072354775c0892a1
SHA512 f3bf93c69ee4fcb7a486e2c4e31d1b2fd53a7ff9ef1d29463c97d946cb49a08327400cb4f0045b3d5ba3652d8c5f5e710bae01df6bd93265366234554d545b47
SSDEEP 384:IdiFzQkUSvczsNt8TUNTUlIllPoA/bT8Yh//z8ExUXQ7VvaTZcSu+qIIl3l:PFdgIwgak/D8Q7VvaTZcSCLD
TLSH
T120A25C336898EC3B5EE79A90F54A3213DFB08167CAD49BA0E7DD9A2C01DA1DC1347D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dab6a00a-0664-4bfa-9188-2b3b9b1869cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dab6a00a-0664-4bfa-9188-2b3b9b1869cd.tmp
Size 8KB
SHA256 3e73b41d4bac93756015f527ddb91c4cedf02f5d42686f86c345f7cd5f316095
MD5 427a907dc6c271617b14ce64ba1648e8
SHA1 02523be260923a34df74575d9a9864df3ec0d8b7
SHA512 21f3d2f6973b1567345385eec4158af784460903fb29aee32af262d230a2f7d742d38bdfa3cf172a8fc8f8b28057a001006f10faf7bbbe5cfc3c66107248cdb7
SSDEEP 192:+ONe6JU8QmiUy5poo//jjzorB6ywxW5XQdNxAqvU6:+ONe6+M8oo//z8ExUXQFVU6
TLSH
T1EF12F935B868BC7B5DE3A594B0473213DEA0412BEB895F90D6EC2F2C01DB15C534AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59974b7f-0767-4d36-b87a-79bfe64c5be0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\59974b7f-0767-4d36-b87a-79bfe64c5be0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fb6fc493-291a-4525-8c00-ded4621ecf68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb6fc493-291a-4525-8c00-ded4621ecf68.tmp
Size 18KB
SHA256 277e45f35c0b364f72818c4c4026a1601a80c1853086057b25f15d088ffa78e9
MD5 fce56683543bde6a942440cffe29a620
SHA1 55927f32e574f0408dd836af18e8ccee58ef453e
SHA512 df88df0a8cd4c305992c03d38f1de3bdd58f0ac687f07455bae4581041a9f8ab51e508534c5908b3c30126d69419a90066922babd6b77218c88e64a84d7a59e7
SSDEEP 384:AQkUSv0sNsUgPoA/bT8Yh//z8ExUXQ1VvaTZcSu+qIIl3l:o0yk/D8Q1VvaTZcSCLD
TLSH
T15F826D367869AC374EE7A160B04B3613DFB08167DBD41F90DADD9B2C01DA29C2347D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5f78981a64b8000e8c217ca0f07d0cb07ac66634e5983d7957b51ab6006c63be
MD5 271123a4ff3f69827eeb8a5f8856dda4
SHA1 69550840504d1d98366c4273603625746cbb4bd3
SHA512 ed45e9dab8472fc3d80630690a35bed2ee424ad666d55baaeb1f7ebccb582c51be7460014e5bf2a35979d6002f644eed9091c52d841f618787823f439997121e
TLSH
T17E410C5CAAFA1149B3B76F1A9BF6686D447FBC772E06D45D10510E4F0A23A00D8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download