hxxps://storage[.]googleapis[.]com/qsuifdtqzeuyfquisdyfiqdf/qsuifdtqzeuyfquisdyfiqdf[.]html#6ERAHZIDRLZ9UON2YY5YXLK0UOO6ZU9BE6R1WZ5T

Analysis

user interaction
yes
max time kernel
174s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 08:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://storage.googleapis.com/qsuifdtqzeuyfquisdyfiqdf/qsuifdtqzeuyfquisdyfiqdf.html#6ERAHZIDRLZ9UON2YY5YXLK0UOO6ZU9BE6R1WZ5T
Sample260720-kmp7daev7z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
984	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290106120522386"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{CF4CA035-7240-497A-A421-20C7272E7DE3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 3132	4708	msedge.exe	85
PID 4708 wrote to memory of 984	4708	msedge.exe	86
PID 4708 wrote to memory of 4712	4708	msedge.exe	87
PID 4708 wrote to memory of 4712	4708	msedge.exe	87
PID 4708 wrote to memory of 4712	4708	msedge.exe	87
PID 4708 wrote to memory of 2000	4708	msedge.exe	88
PID 4708 wrote to memory of 2000	4708	msedge.exe	88
PID 4708 wrote to memory of 3264	4708	msedge.exe	90
PID 4708 wrote to memory of 3264	4708	msedge.exe	90
PID 4708 wrote to memory of 3264	4708	msedge.exe	90
PID 4708 wrote to memory of 1756	4708	msedge.exe	91
PID 4708 wrote to memory of 1756	4708	msedge.exe	91
PID 4708 wrote to memory of 1756	4708	msedge.exe	91
PID 4708 wrote to memory of 3088	4708	msedge.exe	92
PID 4708 wrote to memory of 3088	4708	msedge.exe	92
PID 4708 wrote to memory of 3088	4708	msedge.exe	92
PID 4708 wrote to memory of 4280	4708	msedge.exe	93
PID 4708 wrote to memory of 4280	4708	msedge.exe	93
PID 4708 wrote to memory of 4280	4708	msedge.exe	93
PID 4708 wrote to memory of 4964	4708	msedge.exe	97
PID 4708 wrote to memory of 4964	4708	msedge.exe	97
PID 4708 wrote to memory of 4964	4708	msedge.exe	97
PID 4708 wrote to memory of 4248	4708	msedge.exe	102
PID 4708 wrote to memory of 4248	4708	msedge.exe	102
PID 4708 wrote to memory of 4248	4708	msedge.exe	102
PID 4708 wrote to memory of 2572	4708	msedge.exe	103
PID 4708 wrote to memory of 2572	4708	msedge.exe	103
PID 4708 wrote to memory of 976	4708	msedge.exe	104
PID 4708 wrote to memory of 976	4708	msedge.exe	104
PID 4708 wrote to memory of 568	4708	msedge.exe	107
PID 4708 wrote to memory of 4768	4708	msedge.exe	109
PID 4708 wrote to memory of 4768	4708	msedge.exe	109
PID 4708 wrote to memory of 4768	4708	msedge.exe	109
PID 4708 wrote to memory of 1188	4708	msedge.exe	120
PID 4708 wrote to memory of 1444	4708	msedge.exe	121
PID 4708 wrote to memory of 3640	4708	msedge.exe	122
PID 4708 wrote to memory of 4936	4708	msedge.exe	124
PID 4708 wrote to memory of 4936	4708	msedge.exe	124
PID 4708 wrote to memory of 4368	4708	msedge.exe	127
PID 4708 wrote to memory of 1008	4708	msedge.exe	128
PID 4708 wrote to memory of 1008	4708	msedge.exe	128
PID 4708 wrote to memory of 1008	4708	msedge.exe	128
PID 4708 wrote to memory of 3696	4708	msedge.exe	129
PID 4708 wrote to memory of 3696	4708	msedge.exe	129
PID 4708 wrote to memory of 3696	4708	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://storage.googleapis.com/qsuifdtqzeuyfquisdyfiqdf/qsuifdtqzeuyfquisdyfiqdf.html#6ERAHZIDRLZ9UON2YY5YXLK0UOO6ZU9BE6R1WZ5T
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffad220c188,0x7ffad220c194,0x7ffad220c1a0
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,11963258000098666859,6281410777871715445,524288 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - System Time Discovery
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,12768101520528113419,16787789428593334533,262144 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,7910606216789047510,9734171007534735014,524288 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,5963441879674691641,15865629155276188992,2097152 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,64344531443913313,4863435909007800778,2097152 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,5506559133940054839,4110227861822019548,2097152 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,11591739274042933566,3314356049845873920,2097152 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:2
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5196,i,2335278999480130826,15492252252004404609,2097152 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3500,i,4273345505381146971,6117095767281837356,2097152 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,16867684974840198110,12644262525466745892,524288 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,2687634536310421296,1835694983223821734,524288 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,1729418083466758923,15881304141250244220,524288 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,1729418083466758923,15881304141250244220,524288 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6184,i,11396007314588635240,13316150766854978519,2097152 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,2986479407595311048,7867535337860947707,524288 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,18036191270400064078,1408806933709691087,524288 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,1993500370514615385,15441072560786050908,524288 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,259706206056183576,594580793624070817,524288 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3640,i,16958193297619021079,4886928428997453813,262144 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5832,i,30817293898530203,1206999155201041643,2097152 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=1544 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5488,i,6824492671973008265,405636090597128055,2097152 --field-trial-handle=1872,i,17115761940741509041,7808779489422401114,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 510a24eba478d76d391f243d30968c60fc622354b5de7a9bab38b1a0e8297518
MD5 682e5427c6a9cc9bee740253d129564e
SHA1 791198235160639d4548351ab66737c90816fd8a
SHA512 f9fb23a94c17229194162418e9863aea68b7e723128187197e6fa86f5e5a527eba5ded34f59bdc90b092150e739a63cc5397efb8dc2d1aff577a071026f36761
TLSH
T1F461B4710A9312B1EF14C63294DD024D3773C6F7FA1B6E8990809633761231EF3159AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 40523caf67863e56b1c021926334c88f383027f3222b07d11328f1a6ed1b5938
MD5 0dafd4b96a85395a9c745c42a7323d72
SHA1 785db34bb015b3fde76c57923742995b780aa73a
SHA512 10dad44d6c8900112794859e69b054aec5715ed897e1cbf7654eee8af66dd8a465651d2bff399587ddfd62ed5dfd8f9060d13c855d1401ac017b591179817a5d
TLSH
T14E71C675099312B1EF25C23294DD025D3673C5F7FA1B5E8990809A33BA0332EF3549AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587088.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587088.TMP
Size 3KB
SHA256 14baa2fe82397747fb25db29ab53191cbf7ca1dbb0963c7134b31cab04618301
MD5 babe2d3222a9bd3a21c3e4803855db59
SHA1 c36cc10bf0cdc777a9a717e5efc2082717f12a19
SHA512 7d3fc02d496781c9b8bb0d948d3fee6ea2b75c90ae4988b0130b34a872c503e94bde30019779c5ea332500960a489d886bc414759cc91d77c0391db81d194485
TLSH
T1C461B4750A9312B1EF14C63294DD024D37B3C6F7FA1B6E8990805633761231EF3259AC
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1e2f21c8528f2d54bf704b70326831eefbf46d5765e32f3a40845bb89f110740
MD5 7251d6c4ae5eac64f7cd110e694445d7
SHA1 da857363cd50c3f66edd83e36644215b7db7b663
SHA512 4b883cb55ae9eeb7779a5fb339a4eca581cf5abe6370575f1585219cb2f5ef796ae18e401ff5b6337055638e21b76f3ebc9c308a1ec3f7035355e180a3140a3e
TLSH
T121519BF38BE5866ED91156F0AA147E17CF1D0A94435C3C46C9E8BF1BA3E2471D20269F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bac6a1a8415e1fe276d0d70ecb2f3f5694e4275fbf377c9bbc66c7e2359401b2
MD5 20e95fd8e63d5955c14897a6aff0c351
SHA1 84044fe9b0a71641724b3e55cdfb48f644cc0c43
SHA512 240dc55a101b97060ee67be956f573d3280febf707a8a1bb9768457ebfe84716fcee5300e7042c7b8931624662374ec311740de6d3fe4451f98468822685a685
SSDEEP 192:sxZvRwyM/jK1Ml8Mkx/fysN9Pb5VDIdptoQcullH6I+6+WN+l5YCGp3/YvZDjYmC:sxZvSMx/fyszPbotFHRQah/uJC
TLSH
T12252C656AA349ABBCCDAD609B941BB53D6F51462D2940E44AAFCCF1C04E6BDD230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 931b65d41d45e86a01eaa5f69aed820bd92740214280e921124933fdbed23636
MD5 6da3de9272b96d0280c15176c6db6f6e
SHA1 8a1729ada226bfe63ab495794c9d15dcb373db14
SHA512 de52bb852206b6e6fac554a6749583bf059ebc38ec7b0d517521509e74d80c85e4dca76a37f25e3657a6f510a8157174fc499b068132d0320b720b7d39bff87c
SSDEEP 192:sxZvRwyM/jK1Ml8Mkx/fysi9PMkVDIdptoQcullH6I+6+WN+l5YCGp3/YvBxjYm9:sxZvaMx/fys0PMLtFHRQah/uJ9
TLSH
T1FE52C656AA34997BCCDAD609F941BB53D6F51462E2900E44AAFCCE1C04E6BED2307C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cbe1a3f0b4f1a8df02a475b40d7fbf2128122fa7f2fcbdb211169f7a08df8451
MD5 ff4fd1102a3c34ce472dcea36d26e9d9
SHA1 f55657d835c34b9911e67bc15f778908d2fcba9d
SHA512 07a6272945e9c7c51ec25261af540177b8f6b0b0a8f1f119586b9a48bb661298dd16a15c28c7c98025ab61d491cd0319cb15d8c5949543c296a8bd584009ad6f
SSDEEP 192:sxZvRwyMojK1Ml8Mkx/fysN9Pb5VDIdproQcullH6I+6+WN+l5YCGp3fLh/YvSg8:sxZvhMx/fyszPborFHRQah1/SJC
TLSH
T1D462C656AA345E7BCCDAD609F941BB53D6F51462D2A40E44AAFCCF1C04E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 77740f4f4436737eec20f26d359a105fd11954ad644b601744cab9ade5adcd70
MD5 9a7fa6acd676c0512f41109a71eb50a0
SHA1 8a21e4d04fa02d543d547aae29f95050220573a2
SHA512 944d0a5d586c7328a90329d5f0290afe40b31cbd5693387aabff33ff204770c2290788d96830fdb7eeb8fd84ea6788d1ca85a7a3ec308d1048215f83ba4388de
SSDEEP 192:sxZvRwyMojK1Ml8UQQkx/fysN9Pb5VDIdproQcullH6I+6+WN+l5YCGp3fOVlYvl:sxZvhqjx/fyszPborFHRQah0l5JC
TLSH
T11562C756AA344A77CCDAD609F941FB53E2F52466D2940E44AAFCCF1C04E6BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1596e0718756c84eb62a41d8328e34d3e2266a4561bd2d5b1d688cf352115734
MD5 06a1b7d2527137a3d3258f8ce54eece9
SHA1 3cb715a08cfe5d45ad4a4dab557a210e72a62f82
SHA512 b5161476567fb94b5fef4bf0a267bb671d443e0c79d4b39a4e4f1aaacb1a25c95191c1c88d934d3da9e7a94548fc30ea49bac50c61680b1707330f3708b69067
SSDEEP 768:JNseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppurog1:JNseJ3xWvhfynu1jaVcL88plW
TLSH
T1E2D20B2B680CCB7E4F844E6CEC266F966EE801CB67984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ecbbbff322c7a1d6103fbc5db562f5fe763382820fb4987aea047ce4af470659
MD5 fecce961eb47fdef3ada055783d4a045
SHA1 5fdff6f2c562079d635456a6b788500ecafe582b
SHA512 00270960adf987ea9459855ad7bd9cc17748b6f9f5d0ccd69803328c5d0637dfd579bf39919dcda3edfbfd43eaf95595221fe30bec5095980bc36605284be6c5
SSDEEP 96:KYH+KggmBd+K+ci1WJS2wI42OID9422KAT4c2seWrMWnyz:49sd9pa
TLSH
T1DF918302367B02013C7D294CA2D1E5764EC235A37419A5AF7FBC44A65EA7E128EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8eb1b24f-509e-4adc-81d2-5cb34d84e5fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8eb1b24f-509e-4adc-81d2-5cb34d84e5fc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 879fd134e183ceef958cbf24ef0aa7aaefd7f2ba290f6a5dd6d5e2cf86a08992
MD5 07d8c86fec2032adf92439f650bafc86
SHA1 39e1124c78f5d8c073ec5b2a15eb19f6fa9e2c73
SHA512 e7a60fc671b717c96134ff87ab7d3ae1cb1d0498605e85a4ad7cb1fa55da238800ce12c6c465351ed0869d53ab0b176e4af8c38150ebda4c4323981cd7e0db39
SSDEEP 384:OiF1tNn/s3n9SVzsNg8TUNTUlIlC4emZ7X/sHEvzFIKPlmIlxa:lF1j+9ihwg/eCbKELFxlmIlxa
TLSH
T162B2F8F258D7893AD9AE5B43B77D2E024EBCC167B5805950B7C82E1CCC9A1BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 1470a4db996aca1ca603006f49e3380de879f369b64206d5e5f82d236769a422
MD5 8d971f0ef68b986d3705c06325cc7b19
SHA1 660f364f51153361fb41b513439fa8eb71f8a3ae
SHA512 37b8e5cf66b33897bb329af1f1dc30c70c49642131036d9b09bb9908cafa7e23c1e915d5d2616fff1a4e844bec66ceda523881474c6faa257894ed0820b2e555
SSDEEP 384:4tNn/s3n9SfsNg14emZ7X/s3EvzFIKPlUIlxa:4j+9UqeCbGELFxlUIlxa
TLSH
T15A625C726C649D2B9DE3A694F54A33071FF441ABA6C46F50EADC3F1C04DE26C1307A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c97345239ce25aa581380d5ae48d45e1ead5cec77650682c918764134b4f02e3
MD5 4ae607b5d8ab47b6448e7f7ea59dcba1
SHA1 b2829bd6154e80db321451cff334af90cdda8d93
SHA512 d979da36fc933aab23c72a23dd2eda3765f1acb749c08061011ed3ef3ab139a1f0fe6d2f5d5c3bcd1bef09416d13e8f6efd6ea4fa23a9d339ef7e9607527b063
SSDEEP 384:utNn/s3n9SfsNgC4emZ7X/s3EvzFIKPlUIlxa:uj+9UpeCbGELFxlUIlxa
TLSH
T18F625B766C649D2B9DE3A694F54A32071FF441ABA6C46E50EADC3F1C04DA26C1307A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 683da943025ff4c71a2151e62d61bcf508e43508223d9119639d041965fe1d64
MD5 92d1277931e73fafbda220f456cb07f8
SHA1 828dc6d3b60a90f32d224302244cf7f20f0ee6b7
SHA512 506f0da67a13c2bf440bda64fddb23171cc38a656fa96da176b668663f0c4cbdcb771d598a890a4fe6139c28f372bce66f22c025352b140c08dc9b0ce3443e3b
SSDEEP 192:lONG6vMtPQmiUyPtThTobWCIKp847IaLU/u:lONG6UtRiTiFIKRIUU/u
TLSH
T187020876BC685C7B9AA3BE45F48E27171FE411AFA6A05B50EAE82F1C00D765C1303927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 a4693834b10954fe06b91f03bbbb935f9566ee68c3fa4feca41e9302fc2ccb00
MD5 4d4264a87b7f4add1f4017c9430d5efa
SHA1 d2e853c9a69ac9b7e5d01568e28f18e1adb2ef68
SHA512 10e11b2e0335c9c857216d33a759c16a80eae2d337a15d715c18256acca816d041f3316e3f7cd55aae0aea8d8bf77b07fa0bc3dc54c014358943f94040062453
SSDEEP 192:IONZ6vMz/PQmiUyFtEthTobWCIK++Wyil80IIXq2U/u:IONZ6Uz/R2EtiFIKPlbIlU/u
TLSH
T114120976BC649C6B9DA3B541F48E32131EB4826BEA849B50EADC3F2C01EB56C1307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a3d4881-a478-4c8e-a439-ff4848087ad2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5a3d4881-a478-4c8e-a439-ff4848087ad2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 58f4c283ad781af2fba2e8b3034688276627379512daeebaa44f0e8ea526ea9a
MD5 18e17a74399b0672bd47339427851358
SHA1 b15a1fc04f8d22683d7c2c8c7204ddff86270d92
SHA512 3a6227aca2690d9d1b00cca3b3eb733024f3a34d835ce949a108eaa88fb8e8cd856ce10450afe4b2c9184374e5e4dcd808ea533bf3377c3923a3108a7d613070
TLSH
T1B2411898B6E91148B3B7AF5A9BF6A87E487F79772E06D45E00010D4F0A66A40C872733
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download