hxxp://bit[.]ly/myadp_registration_guide

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bit.ly/myadp_registration_guide
Sample261027-tkcypsvxbs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3728	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{E69F6CF9-777F-4508-8896-5B101C4CE222}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2000	2272	msedge.exe	85
PID 2272 wrote to memory of 3728	2272	msedge.exe	86
PID 2272 wrote to memory of 4900	2272	msedge.exe	87
PID 2272 wrote to memory of 4900	2272	msedge.exe	87
PID 2272 wrote to memory of 4900	2272	msedge.exe	87
PID 2272 wrote to memory of 2052	2272	msedge.exe	88
PID 2272 wrote to memory of 2052	2272	msedge.exe	88
PID 2272 wrote to memory of 1756	2272	msedge.exe	89
PID 2272 wrote to memory of 4104	2272	msedge.exe	90
PID 2272 wrote to memory of 1756	2272	msedge.exe	89
PID 2272 wrote to memory of 1756	2272	msedge.exe	89
PID 2272 wrote to memory of 4104	2272	msedge.exe	90
PID 2272 wrote to memory of 4104	2272	msedge.exe	90
PID 2272 wrote to memory of 760	2272	msedge.exe	92
PID 2272 wrote to memory of 760	2272	msedge.exe	92
PID 2272 wrote to memory of 760	2272	msedge.exe	92
PID 2272 wrote to memory of 4792	2272	msedge.exe	93
PID 2272 wrote to memory of 4792	2272	msedge.exe	93
PID 2272 wrote to memory of 4792	2272	msedge.exe	93
PID 2272 wrote to memory of 3812	2272	msedge.exe	96
PID 2272 wrote to memory of 3812	2272	msedge.exe	96
PID 2272 wrote to memory of 3812	2272	msedge.exe	96
PID 2272 wrote to memory of 676	2272	msedge.exe	98
PID 2272 wrote to memory of 676	2272	msedge.exe	98
PID 2272 wrote to memory of 4596	2272	msedge.exe	99
PID 2272 wrote to memory of 4596	2272	msedge.exe	99
PID 2272 wrote to memory of 1080	2272	msedge.exe	101
PID 2272 wrote to memory of 5028	2272	msedge.exe	109
PID 2272 wrote to memory of 5028	2272	msedge.exe	109
PID 2272 wrote to memory of 5028	2272	msedge.exe	109
PID 2272 wrote to memory of 4684	2272	msedge.exe	110
PID 2272 wrote to memory of 4684	2272	msedge.exe	110
PID 2272 wrote to memory of 4684	2272	msedge.exe	110
PID 2272 wrote to memory of 1856	2272	msedge.exe	111
PID 2272 wrote to memory of 1856	2272	msedge.exe	111
PID 2272 wrote to memory of 1856	2272	msedge.exe	111
PID 2272 wrote to memory of 1240	2272	msedge.exe	112
PID 2272 wrote to memory of 1240	2272	msedge.exe	112
PID 2272 wrote to memory of 1240	2272	msedge.exe	112
PID 2272 wrote to memory of 1668	2272	msedge.exe	114
PID 2272 wrote to memory of 3596	2272	msedge.exe	115
PID 2272 wrote to memory of 1576	2272	msedge.exe	116
PID 2272 wrote to memory of 2960	2272	msedge.exe	118
PID 2272 wrote to memory of 2960	2272	msedge.exe	118
PID 2272 wrote to memory of 1768	2272	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bit.ly/myadp_registration_guide
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffe9671c188,0x7ffe9671c194,0x7ffe9671c1a0
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,1178730089751447983,11640705661067341465,524288 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,13979018580348394510,14879805755505736044,262144 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,16283822629624095059,1679434609309012284,524288 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,7844080142125508528,15658896279913386892,2097152 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,15542823054760769973,17866549917714697506,2097152 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,8943415892029395814,7313625887864942495,2097152 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,7253947806341091967,18129416416428871026,2097152 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:2
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3708,i,4308794958879852619,3005432071323783826,2097152 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,17646357675156280859,3004229912695545082,524288 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,5532279255904434761,2000668578254872368,524288 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,2612987705208483041,14587893826237582212,524288 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,2612987705208483041,14587893826237582212,524288 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4796,i,17649251177577346957,5785639368485245032,2097152 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4328,i,15004347785154181737,6200945160998614585,2097152 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6464,i,12267526336593656261,16245730657854050294,2097152 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:2
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5172,i,5980388657306220854,14391866913567370149,2097152 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,1256947703642069367,16789063585140957224,524288 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,7297359891758649029,7435837704568365941,524288 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,9219529020058327984,4777180952456101898,524288 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,12994895320862267715,2221239902286395428,524288 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,1131848292878646098,10333789602662536689,262144 --field-trial-handle=2324,i,11488858619287976565,9930785298536375763,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

315ba3d6-5592-4533-a5dd-8d6458ce3bb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\315ba3d6-5592-4533-a5dd-8d6458ce3bb7.tmp
Size 18KB
SHA256 626757988eade993b64cfd4c88b9119f79a0d7ecbf10f412e6d5438efe94597a
MD5 14aa0d4094a3e61f57ee0419cc2ad22d
SHA1 5051a4752576bcb01048a53bd7487a2e3a6f754a
SHA512 646affa5c1536703c302debb33ccbcab7fb50600e0c9666125dfb02cf2563436673e8e6648c09dddc51c39c200764784a6dec7f459881562f29bdfa7e4aba6bc
SSDEEP 384:VQkUSv0sNBBgJh5U6qduBGYX5Ejl83sIXHu0vaTZczIIl5:v07JhVqiGYujToHu0vaTZczLX
TLSH
T111826D76B879AC3B0DD6A651B14E3613DFB4D127DBC42F90D6DD5B2C02CE288235B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34f74827-6667-49d5-a8b8-29e307068c34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\34f74827-6667-49d5-a8b8-29e307068c34.tmp
Size 8KB
SHA256 889e5e00d9712b36f37f424a72c13c55e19465a094857df098ae1154074190ca
MD5 2ee60532c5ddd5e3b76da5e69840e054
SHA1 3e7af5172e69e15b3eb1853560775e0a0c36f99c
SHA512 5a789f0772bd9a8f72cc61c2cd473fd955a8f0565c88ccfbb28c8473e6fca3ece44124fb265907aba189b47a8122df395b9a950d26ec5d9464d7b3cb174ed0d3
SSDEEP 192:LJONI6DphmqQmiUyRoq8wGYX59ezKCpjzor33Ikk719U6:lONI619pRwGYX5Ejl83GbU6
TLSH
T1AE02EA35F8787CBB5DE3AE49B44B27139FE5212BAA946B40D6E81F1D01C764C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

689802f3-e7f0-4e24-8f41-c638f1f5b394.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\689802f3-e7f0-4e24-8f41-c638f1f5b394.tmp
Size 26KB
SHA256 574c2304e3143deff6e45e2640995ff4fcaa18549272ed77a961375291e4a69e
MD5 4470012843e57273bc80d11ae991c687
SHA1 91d582d383eb7bea56a7284c4677a4374742e5ae
SHA512 27c4017fc60f75b509a5e551dd904fba6315af9ca2aa6522c25c25127521baf93b15c33f3ea3004048d6bec6b98e2e18c5290549c3878dc8047b0ff952ed1396
SSDEEP 384:YiFzQkUSvVzsNT8TUNTUlIlBgJh5UjqduBGYX5Ejl83sIXHc0vaTZczIIl5:jFdt2wgUJhkqiGYujToHc0vaTZczLX
TLSH
T1BFC219F258D7983BD9AE9743A33D2D038EBCC167F5845A90B3995A1CCD8A1BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

887be940-557b-48a6-9acd-a6ec898e886b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\887be940-557b-48a6-9acd-a6ec898e886b.tmp
Size 18KB
SHA256 11bf28c18a2607d34df01cef43484e5f171d480249b5a684ec8df214d987a011
MD5 3eb682bc025de843144e75d4b8799de7
SHA1 3b66d197653141bf433d243fe6b961d50ad04e3a
SHA512 69853cf29910f336ada78b7db6ae92efc46ff74089391908aef678529765a49bac7880dfb105d9b3a209dcff2d258b77197d0dc8d3fbc0e7b4fcc9c3fcdb78b6
SSDEEP 384:fQkUSv0sNBkgJh5U6qduBGYX5Ejl83sIXHu0vaTZczIIl5:h0qJhVqiGYujToHu0vaTZczLX
TLSH
T1D2827E76A879AC3B0DD6A291F14E3613DFB4D127DBC41F90D6DD5B2C02CE288235B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

00179e2d-4138-4823-bef0-a9c3dc60f3fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00179e2d-4138-4823-bef0-a9c3dc60f3fa.tmp
Size 27KB
SHA256 e0f5584ea3f68350e7d22f5e9d0c9dd22763463ccd76c65cb90a7dd9c2eaf624
MD5 8943b842347786d9fe10ec6c839007aa
SHA1 7a54fa32101d8cd0f57214835bd3506562b9eda3
SHA512 b2b0808aea849b8f2a632ef4e46b95ca4c3ae02f01edd9b61743cf1bc751a0d223287c48ef53aed408ae545ad33bd4070369f9c6d3986ce1233ca61ea51fd098
SSDEEP 768:oBichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzjro4kzU:oBichfPWvPZplu1jan+LKgzQLU
TLSH
T1CBC2F97B640CCB7E4FC01A9DDD1A6F9A7EA802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

427efd88-18db-4f1f-8866-1e3bbde063a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\427efd88-18db-4f1f-8866-1e3bbde063a1.tmp
Size 10KB
SHA256 82ddf6d2999b58d9c4264bb1f04ea3b754ed5736ff1aff40d1acde2de29f53c4
MD5 36d22204b54133ada7ca470ebc3eeda8
SHA1 4df35cbb53b1f51d60278ae8968bc4e200f9df4b
SHA512 adb0e9cd9efbe709d3ba462f793f79c3b134da64037e824fe45726e01afb8b6651d30789bc41131ce3307659bc2299c32ced9c7694382ffd2158f3d2f01f3f7d
SSDEEP 192:sxZRRgWt/fCstNIdpfdTHW6+WNjxZm/Ygb2OwI+EIg5RJ:sxZRlt/fCstu5Hbq/cORh
TLSH
T16432A7527D246A7B9CCBD21DBA15BF13E2F9503291911E88AAFCCA1C05E7BDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d3f4052-9240-4f42-aa95-9e63714d51c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d3f4052-9240-4f42-aa95-9e63714d51c1.tmp
Size 9KB
SHA256 002e1d9f58249034abf2455fbb4bb780bd45156cc1d8ab7b64af0303cb29c90a
MD5 7b0c1d9ca1f6d9c7e3f4e76240571449
SHA1 3b2a17d4d3f16c67eeb2b78cde1fbb7aeb410586
SHA512 2f50df07929b35d53e865c3db6269d070a71f5f0632e9565097bb8d40dbdd32da318a1e795aceb397987b6a4202b8a7aa0b9015ce512c156f6c1a92afac71ba2
SSDEEP 192:sxZRRgWt/fCscmIdprTHW6+WNwZm/YgAe+EIgrJ:sxZRlt/fCscHnHbj/V9
TLSH
T1AF2298526E38A97B8CCAD20DBB15BF53D6F9503291901E88EAFCDA1C05E7ADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9de89bcc-f713-4f33-aa9c-bac6d5061105.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9de89bcc-f713-4f33-aa9c-bac6d5061105.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 248c7b2fa6dd693c72dd46127ba64aa2f0b4ad695113064eefce207206c663df
MD5 fca69c3ae60faa41603432f24e0cb908
SHA1 aaea4c594340b807620cde699f1093f68ced9ae8
SHA512 1b2cb0843ccbff0a01a20331fe28ecc848cf002ac7f1681ea5007ec75be5bdf408e0983d1609b8b91e0e81e8da1e2e707069793bd796b11760660013b9657317
TLSH
T1C071E8E9C48242E8FBF9037D97D13B473A79B9D870436E230096EC7B540F389A58A0B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 56c9bf7d4a719cb6a6719c7805db1ef31f0de238eaa882522bc45120768a823d
MD5 7a3e988fb42377ab60bd940af0eb7329
SHA1 2487705a23ee2bae50f7d3fc3c308b57a3370435
SHA512 d6935de93d24a2bc84afbec26d0827d7a09c29184a324913696f796ec2929a9b91ba6a59fa2999f43dbca4984d53ff68a29381c6e23a7f6d6f0884b74d487e6c
TLSH
T1C261F8E4C58182EDF7F8437C97D13B877A38B4D8B1836D2300A6EC3B580E359AA86074
MD5 SHA1 SHA512 TLSH

Submit Download

b5f5ef27-40da-47c0-bd60-d7143fc2fc9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b5f5ef27-40da-47c0-bd60-d7143fc2fc9c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

15f51074-b423-4658-9850-7e5b7b7ff919.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\15f51074-b423-4658-9850-7e5b7b7ff919.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

1c1aad41-d72f-4815-9066-664148be66b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1c1aad41-d72f-4815-9066-664148be66b7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

502a7259-8b44-459c-97c5-6a0c039ef52e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\502a7259-8b44-459c-97c5-6a0c039ef52e.tmp
Size 2KB
SHA256 d868f7d50983d834ba820028ac05ac0cba5934c7ce632e0c657285d54e620b86
MD5 d7484a81ab9d43b99cd4966a124d314d
SHA1 0d9c1d12c330071c00b84b7713e256a6e13664a6
SHA512 788c64334bd0e01e1cfcb8f0ddcd31f8fb605a0cc5a10259327eeff4525b3c885f32596f0ba33aaf328ebf4cf29e4ea951ce9772a0b591cecd97deb30353a050
TLSH
T19F419DF3C7E98A6E8E1256F0EA146E1BCE1D061783583C1786D8DF5793F24B1E181A4B
MD5 SHA1 SHA512 TLSH

Submit Download

dc788617-0ec0-471b-a7ba-9e9a5bb328a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc788617-0ec0-471b-a7ba-9e9a5bb328a5.tmp
Size 11KB
SHA256 f982c95ec34fcff08f380d64c6e67ae01c6f49511668a4c14d07c3f787a8a716
MD5 9eba891e7af5ccc58a17b04788ed022a
SHA1 058b2425c1eca9d34ec1782d03bb1c334ca893a3
SHA512 435dfaee4f54fe852a3ecd0813c7ba0f5d9215edfbc73cd59796c7c9ed980836fadc3ffce166ff28be7441539f211efa83c5592776b1216fee09a7799cf89b6d
SSDEEP 192:sxZRRgWt/fCstNIdp1dTHW6+WNjxZm/Ygg2OwX+EIg5RJ:sxZRlt/fCsturHbq/fO0h
TLSH
T1A832A8527D38697B9CCBD21DBA15BF13E2F9503291901E88AAFCCA1C05E7BDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fed1b6e1-72da-4069-8ef4-0b4b13e7c907.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fed1b6e1-72da-4069-8ef4-0b4b13e7c907.tmp
Size 10KB
SHA256 a78745748d533f1065c104a66f42e20cc26d25ae4ef8cbf2b5f2430ab96c7695
MD5 75d2148c26549ae00de2a655210031dd
SHA1 3e96262d47be5424d95f09892c8dbf930884e68a
SHA512 a843e3069916fd9216122a7092d4a2757865ffd777404365ff079f566e7a5175c4504af4d8697049f2d9f16e7626a7e438fbee043fafb4deafaaefa90ff3aaa2
SSDEEP 192:sxZRRgWt/fCs5NIdpfdTHW6+WNjxZm/YgAGOwI+EIg5DJ:sxZRlt/fCs5u5Hbq/1ORf
TLSH
T12B22A6527D346A7B9CCBD21DBA15BF13D2F9503291901E88AAFCCA1C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b5ef07e-4976-4090-a0af-a94c5234d167.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8b5ef07e-4976-4090-a0af-a94c5234d167.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

bf850d8f-28f6-4cda-81ce-c75ac377054d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bf850d8f-28f6-4cda-81ce-c75ac377054d.tmp
Size 8KB
SHA256 be7de03460ea8213ad87d21ae81788ffe1778157a16368c5efdabc9818352524
MD5 3bde9d338d4b876e98be49abbe99c427
SHA1 81619e33c8820f75916acbb469cbd59265dd49fc
SHA512 09af7a16b58b7747d7dc26a729d74e6b68ea24abc15ced64577578c3fc3727bbd6e1ab533da9774d3177e2f8a4aac19bb48eaffd34aa006bb172ab00a048a761
SSDEEP 192:1ON86DphLqQmiUyHo5wGYX59ezKCpjzor33cIXEEwkII/q5pU6:1ON8614h5wGYX5Ejl83sIXH50U6
TLSH
T11412FB36B878AC6B1DD2A595B04735139FF8512BEB887F90D6EC1B1C02DF698130A936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c03adc67-bd10-4e4f-83d3-876a61b4513d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c03adc67-bd10-4e4f-83d3-876a61b4513d.tmp
Size 18KB
SHA256 0dcf6c7a461b683faa27ec2f6571b8340d4b7426490263b34bf290ff31dd931e
MD5 cbdf8904f9662da5f6209bdfd14f0f51
SHA1 e81113c3ea09cf1ac7e7b0271ba99a3b23a6bf52
SHA512 5a86741a0e74c94e1d36adaa492c0f2a2af09c4e161efc850b0f6a1b9854a41019167fe59334904d45362008f9a5ebe79e57750426072a2565b801ce8914d38a
SSDEEP 384:vQkUSv0sNBkgJh5U6qduBGYX5Ejl83sIXHu0vaTZczIIl5:x0qJhVqiGYujToHu0vaTZczLX
TLSH
T150826D76A879AC3B0DD6A651B14E3613DFB4D127DBC42F90D6DD5B2C02CE288235B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d70cb529-78fa-406b-b3be-148250ba2c53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d70cb529-78fa-406b-b3be-148250ba2c53.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 55ed2a05072e2b61928fad535f3b08bbabd9c4829168644e6e153fc6ce65f3ee
MD5 742cdfe2f02abd4c4f1912691556dd12
SHA1 4ccf038590185b9d024627e60964396bb6f04077
SHA512 e243868b8aa1225af23ec20806948f461bfcc43a175582ce39ef49273d16dab755dcb0cb87a58aa09ae1bd90dacf635463da2e38fc11e7ef1378e06459dc48ac
TLSH
T1F5410648AAEE1548B3B77E5A9BF2A86E447F7D332E07845D10110E4F0A22B44C871B37
MD5 SHA1 SHA512 TLSH

Submit Download