hxxps://storage[.]googleapis[.]com/cdn-assets-001/k0uk5nmx/72umbrkqpe/039v26eavd/0kvtphkr9sre/vmftlgvrtgfi/qkqzzdo14i2/effu4qo6rhuq/ve48y892k63/oo1dn2ob291w/j4ql1qbrt8yd?product_id=SKU-45489&variant=white-lg&cart_session=c9a7126fd2ea&currency=EUR&locale=en_US

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/07/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://storage.googleapis.com/cdn-assets-001/k0uk5nmx/72umbrkqpe/039v26eavd/0kvtphkr9sre/vmftlgvrtgfi/qkqzzdo14i2/effu4qo6rhuq/ve48y892k63/oo1dn2ob291w/j4ql1qbrt8yd?product_id=SKU-45489&variant=white-lg&cart_session=c9a7126fd2ea&currency=EUR&locale=en_US
Sample260721-e934vsgv6w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5260	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290823709898705"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{B9E82BDF-191B-45C8-B493-E86AD7C0D3B6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 4928	2192	msedge.exe	80
PID 2192 wrote to memory of 5260	2192	msedge.exe	81
PID 2192 wrote to memory of 3252	2192	msedge.exe	82
PID 2192 wrote to memory of 3252	2192	msedge.exe	82
PID 2192 wrote to memory of 3252	2192	msedge.exe	82
PID 2192 wrote to memory of 1092	2192	msedge.exe	84
PID 2192 wrote to memory of 1092	2192	msedge.exe	84
PID 2192 wrote to memory of 3904	2192	msedge.exe	85
PID 2192 wrote to memory of 3904	2192	msedge.exe	85
PID 2192 wrote to memory of 3904	2192	msedge.exe	85
PID 2192 wrote to memory of 3452	2192	msedge.exe	86
PID 2192 wrote to memory of 3452	2192	msedge.exe	86
PID 2192 wrote to memory of 3452	2192	msedge.exe	86
PID 2192 wrote to memory of 4864	2192	msedge.exe	88
PID 2192 wrote to memory of 4864	2192	msedge.exe	88
PID 2192 wrote to memory of 4864	2192	msedge.exe	88
PID 2192 wrote to memory of 2892	2192	msedge.exe	89
PID 2192 wrote to memory of 2892	2192	msedge.exe	89
PID 2192 wrote to memory of 5112	2192	msedge.exe	90
PID 2192 wrote to memory of 5112	2192	msedge.exe	90
PID 2192 wrote to memory of 5284	2192	msedge.exe	91
PID 2192 wrote to memory of 1232	2192	msedge.exe	93
PID 5284 wrote to memory of 1124	5284	msedge.exe	94
PID 2192 wrote to memory of 1408	2192	msedge.exe	97
PID 2192 wrote to memory of 1408	2192	msedge.exe	97
PID 2192 wrote to memory of 1408	2192	msedge.exe	97
PID 2192 wrote to memory of 5820	2192	msedge.exe	98
PID 2192 wrote to memory of 5820	2192	msedge.exe	98
PID 2192 wrote to memory of 5820	2192	msedge.exe	98
PID 2192 wrote to memory of 5124	2192	msedge.exe	99
PID 2192 wrote to memory of 5644	2192	msedge.exe	100
PID 2192 wrote to memory of 2052	2192	msedge.exe	101
PID 2192 wrote to memory of 1508	2192	msedge.exe	102
PID 2192 wrote to memory of 1508	2192	msedge.exe	102
PID 2192 wrote to memory of 1508	2192	msedge.exe	102
PID 2192 wrote to memory of 4360	2192	msedge.exe	103
PID 2192 wrote to memory of 4360	2192	msedge.exe	103
PID 2192 wrote to memory of 4360	2192	msedge.exe	103
PID 2192 wrote to memory of 2820	2192	msedge.exe	104
PID 2192 wrote to memory of 2820	2192	msedge.exe	104
PID 2192 wrote to memory of 2820	2192	msedge.exe	104
PID 2192 wrote to memory of 5632	2192	msedge.exe	105
PID 2192 wrote to memory of 5632	2192	msedge.exe	105
PID 2192 wrote to memory of 5452	2192	msedge.exe	107
PID 2192 wrote to memory of 5452	2192	msedge.exe	107
PID 2192 wrote to memory of 5452	2192	msedge.exe	107
PID 2192 wrote to memory of 3408	2192	msedge.exe	108
PID 2192 wrote to memory of 3408	2192	msedge.exe	108
PID 2192 wrote to memory of 3408	2192	msedge.exe	108
PID 2192 wrote to memory of 1480	2192	msedge.exe	109
PID 2192 wrote to memory of 3152	2192	msedge.exe	110
PID 2192 wrote to memory of 3152	2192	msedge.exe	110
PID 2192 wrote to memory of 3152	2192	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://storage.googleapis.com/cdn-assets-001/k0uk5nmx/72umbrkqpe/039v26eavd/0kvtphkr9sre/vmftlgvrtgfi/qkqzzdo14i2/effu4qo6rhuq/ve48y892k63/oo1dn2ob291w/j4ql1qbrt8yd?product_id=SKU-45489&variant=white-lg&cart_session=c9a7126fd2ea&currency=EUR&locale=en_US
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7fffe740c188,0x7fffe740c194,0x7fffe740c1a0
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,7181068201618632456,17150204735317270047,524288 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,16185075953558098056,13399611947488023998,262144 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,3718821680034983349,440197161140066109,524288 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,2019162477476319970,6754845349269742741,2097152 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,2983026846202603143,10248458524967041210,2097152 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4916,i,11939923838816721165,5702931390280130497,2097152 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,17864788270119288786,680599639023473328,524288 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,12075703492410713156,17078789026197073891,524288 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,13921316550577700973,10546284343640394832,524288 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,13870579891071955309,17066715381262285246,524288 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,13870579891071955309,17066715381262285246,524288 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4868,i,7884366367708979844,17351857377432303037,2097152 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3864,i,14142373232925770899,10247614541152700474,2097152 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,15355435826205946657,10678450362415313131,524288 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:14
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,9457307458358178705,8435118658466764995,524288 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,15910242862278619809,12710056694292265908,524288 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4284,i,11911354534275223706,2443207619873369094,2097152 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2024,i,5423725573294430919,3146187835847974024,2097152 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6648,i,308943103796836012,2034636842345410129,2097152 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,11016566224763166111,3806196880725890016,524288 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6608,i,6418786867712081836,4138119954181323346,2097152 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5580,i,18074693170541228211,14969789723968120131,2097152 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2216,i,5799855420677179387,7265612974712156744,262144 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6532,i,220355469993858739,6661433119345546203,2097152 --field-trial-handle=2096,i,15798744943693489095,3906440229328788204,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 45f539846dbdc633d1017fa18d50293cec91f2c6869b6c1aa6478f681bcf3738
MD5 580180f9fc79e5880e13ec3c7fadc4f7
SHA1 589ba41839463a625c80b0ec3bccf0946ac46d64
SHA512 242f3971eb311f10210a0ac4241313149ae2ba6e2d36a01add6b55b9a2ea61484b1711bd02e73fd789245891fb34b4a7c9a548127f7156ac2074dfbda573f005
TLSH
T19DE0E5BACD62AD3B08FD571890605745EB09239B6B41890F3A3CC1088FB163A469586C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ae7dc03fed27e46cddf8f4737db831d4ea1caa8fa4596db0b41ae05cabcc0094
MD5 f5caa5612de014022fc26ff2ada57827
SHA1 2cd5e3c4e53c1400f9ab067f635c7ca4d1775aa5
SHA512 834f475b8d3babd43df0200cde8718b9fc10cc0c40a13149a935921cb57aa8ae1c119f8e442dd3515937b07fc5247848d461902912a39536cb4d85a02ae9e401
TLSH
T18051C1F387E4866EC90199F0EA187E1BCE2C0550435C3D9AC9E4BF5793E2471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6aec6ed897fdcee6e93c2284d7bdfd0d00cf6ddbc69ca72e58c384cb1197bd08
MD5 44320491ce4076accb75e89be167a078
SHA1 ded3680aa9b223434a39552066a6249e40fc1bd3
SHA512 2f5089b9cb1ab19f52928332eee8cb60675135e154f8c2485d55e70b97abf8838068a66eed8d8ab79ec3bf62d2cc77a002cc684de7c85061b324a9e75fb863c2
SSDEEP 384:sxZDBttqngz/f9srplbUEda/bI6z/53q+I:sLBtcngz/fwrbUEQ/bfL5w
TLSH
T11072D606AA744D7B8CDBD219F555BB53D2F91562E2904E446AFC8F0C04E6BEC620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a9617db21150c2683fa8b6320dc35d6bf3f4ed57fd8587be2421b885871abd7b
MD5 8f1ba557b0bfe0ac3136cc2dca6739ea
SHA1 93fe8bb54b348de8376cae3f9290b0f84d7b3b53
SHA512 2972f331ecfd593d64aec80a6eb6ebcebdb89f04891dbbb5cec4d8b55a2aa4dabb3a7956b5b5b61716d5117eed11b2e598bf99a840008a761a7a795103ac8a71
SSDEEP 192:sxZDBRniyMqZjK1Ml8MFgz/f9sDplIKTGZwHmzodpI7/W6+WN5C8l/Y0hxmzELIC:sxZDBtDdgz/f9sDplIUtdG/b5z/5Xj+I
TLSH
T14A62C6066A745D7B8CDBD209F655BF53D2F91562E2904E44AAFC8B0C04E6BEC621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7732d530b94dc5c412be771278fbbcb6781b8d2e60be588c9e791c6f2300ff0b
MD5 e90fa501252f101b5cfe7c9be1150c42
SHA1 cb511144e2cc7a8e9eade0c31142a7aa3b2e7229
SHA512 e4b775a6a0bf4e424adcf8f08c3bc39b55a0712bc8b9e30e25452930d16693d8e02e659270f4cf257a17149d37bbfef79748b015507405551532b46a9bb3b760
SSDEEP 384:sxZDBttdgz/f9srplbUtda/bI6z/53q+I:sLBtPgz/fwrbUtQ/bfL5w
TLSH
T10572D706AA745D7BCCDBD209F555BB63D2F91562E2904E446AFC8F0C04E6BED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bb38d2843fac1676545fd1dbf46602eafc3617f0c3745aa49a1031db89ab22d5
MD5 c258ab0ffae4e902108528daa451bbb7
SHA1 94e44101cf4854bc8266cb0bf62310392e8e9398
SHA512 3ec692d2f7ea16ccdd85ca60febe9a9af8d14ee54e97dc94bcb3cae8992bb419a44865ee591a8d960ffbbb2f42a725ba3cb82349855708e5bfdcf7a2377fc549
SSDEEP 768:wQAKq8y028bWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroSO:wQAKq8y028bWRmj1QWTu1jaKL4LpfiEC
TLSH
T1FFE21B3B284CCB7E4FC44E9CED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 df34b32d22abf2c78a49ced003c137e663b0101673baa857217caae8ffb94780
MD5 4e5e2a8e8b7aa52b1637d350b951ab1b
SHA1 900acdde909dd626f9b796fee182dfbebb46d443
SHA512 09ff8a68aaba00169965ed3761fc7981648917437ff5538513f3c295b563554d235450d94132742e94b8a5a95f37e3201553b673b0a375949b2ac3fae3caaeab
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5M:GZLVDJjEDPV0/ZdsLz
TLSH
T1AAA2570232BA02423C7D390C93979B674A42F1633069AD7F7BA900B64E67E125DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6cff9447df4e04a3af80afa829830cea825beaf40497f3d2ea2a0a39a1e90971
MD5 7f8363d0c3b08912c074af7ef2862256
SHA1 418931b4436e156769f4576cee10166dc2c77299
SHA512 0d4e2fe4761c09c08db6b0c490d64f8530e96d69fb84b4ec993b17544c4efb1fe06a8af96e6548a134a38c2afafc481ab854595d600db885e77fc6ede28adacd
SSDEEP 384:naKiFetNn/s3n9SW8Nt8TUNTUlIRQJ/5Pm3ek32nn9Tn54Jfb8GgFRLCaGBISO5l:aBFej+9fewgqJ/BKekm5TGyRLei529M/
TLSH
T1FBF2B2F5A8D78A76D8AE4B97A33D2D029AFCC163B5481984B7D85D0CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6d177c35338e85f51f21440bcc60fd8fd7d27ba2f930a105285b9f2d4e4f7239
MD5 ab197b875127b12878f6a0fb6ea6d493
SHA1 c579e08027ac4ee2bbb82fd328941d9df35b0a95
SHA512 61ac80bf0338be17fce17e7c571e2628860fb3d453ad4230d6fca5eee3b468c690935be2a2ae610618fb7b1ecf673dbf00e97f4ab010413a0c2df58b344b5b64
SSDEEP 384:nsEiFetNn/s3n9SW8Nt8TUNTUlIRQJ/5Pm3ek32nn9TB54Jfb8GgFRLCaGBISB5l:sfFej+99ewgqJ/BKekm3TGyRLel529M/
TLSH
T1CDD24A35E854CEBBACE78ED9B31E3A12EEE042A3D68C5AD8D5DC5E0C00975DD530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 12a2e35ef28aa3d34d30f86bb54d7a134cc107da77b22492de15026e8618bed1
MD5 1440e3fb6dd7f73277111cd6d356fbff
SHA1 51150d100d92e32d3deb39744f877355ce4811cd
SHA512 4176db60cfb8148abbf344b95a8f2412309df17ee1fbf9b296703bafb1600490128d979d75ab75a51f2d9c44eddbb8113ff94152d616d4803d34de2be7bf4fe1
SSDEEP 384:naEiFetNn/s3n9SW8Nt8TUNTUlIRQJ/5Pm3ek32nn9TB54Jfb8GgFRLCaGBISB5l:afFej+99ewgqJ/BKekm3TGyRLel529M/
TLSH
T157D24A35E854CEBBACE78ED9B31E3A12EEE042A3D68C5AD8D5DC5E0C00975DD530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 01912e18ea3371504e14b6cb9c308e828076c8320c1b1a07eb36244f67a84b76
MD5 10b779937a29a18357279fcd160b2a71
SHA1 fc6011ba2718634be783f07dcaa9fdaee12d125c
SHA512 31ed59b26595bb705dd661a9dd3f3f440455d29f6ab2aad7da292b94675eb908750b848de344b6c722a797d1b16da5150b08217a46cb17f950f3cb49618942aa
SSDEEP 768:sfF1j+9A3ewgqJ/BKekmcTGyRLel529M/:T9A3XJLkMb2+/
TLSH
T144D24A35E854CEBBACE74ED9B30E7A12EEE04263D68C5AD8D5DC5D0C00975ED530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6bbdd5df345e1dbc0936317e7bda777cd33315eb651470272920edd1aefb3eb8
MD5 aec16797454f6b38d57417765f383f2f
SHA1 ab60eab97c5c97838e0c567cd995a9cd0ba6168c
SHA512 2273aa8266044bbcc8c7e90bb0cf44ad5d6cf07cd55b1a185502418eacfdfeb5c863e74bdb5bb369af30f13dd88fce8b4a024e598b712092dc648bd77224592f
SSDEEP 384:naKiFKtNn/s3n9SW8Nt8TUNTUlIRQJ/5Pm3ek32nn9sn54Jfb8GgFRLCaGBISK5l:aBFKj+9fewgqJ/BKekmUTGyRLe+529M/
TLSH
T152F2B2F5A8D78A76D8AE4B97A33D2D029AFCC163B5481984B7D85D0CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e8be8eb5f24964f13025676d0b5e9b76d3c1c3be588457b1f6749c7ef5a86dae
MD5 6792adb7f19bc8f1473303f2eeb4e612
SHA1 dccdffe8c788b19e35452cc1671598816dce5261
SHA512 0f1674d742693307fa32422783a517a6f61df626a7ec6998b197f5543cd21193128ebe1d46494ee8b23cfe2ae7dc707a6786ad87daf8b503d02c3da12866f517
SSDEEP 384:n9iF9CcmyWCs38Nx8TUNTUlIxBPm3ek32nn9+kq4Jfb8GgFRLCaGBIS45e4KV8pB:0Fccps3uwgPKekm9yGyRLeE5I8p0yt
TLSH
T18DC25B35E858CABBECE64F99B70E7602EEE04263D68C99E4DADC1D0C109B19D570B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d969682422abcab4612a6f0c84cc9d2608c0cf1eead392e70fccd2385639636c
MD5 889fc57dbc53f806f2891a672dbdca69
SHA1 08bbf4062581575a0a657e726f6d4ba01ee663f1
SHA512 958c676e9b9d237c7baa44374571385024e1bc5dbe65ead526131ccd5c469516ccedc7ed5e02688b1871f22d59278b04dd6808c154928696c42fde2039cebffd
SSDEEP 384:n+iF9CcmyWCs38Nu8TUNTUlIxBPm3ek32nn9B5Qfs4Jfb8GgFRLCaGBy4Ue4KV8P:VFccps39wgPKekmRcwGyRLeQ5I8p0yt
TLSH
T10FB26C31EC68CABBECEA4F99B70E7A02DEE05163958C59E8DADC5D0C109719D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download