hxxps://planete-merket[.]eu

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://planete-merket.eu
Sample260827-e4w4csdl6t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1764	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322786215063213"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{D31F9A6F-8386-4E94-9282-44D4BC828CA0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 1852	3444	msedge.exe	87
PID 3444 wrote to memory of 4224	3444	msedge.exe	88
PID 3444 wrote to memory of 1764	3444	msedge.exe	89
PID 3444 wrote to memory of 4224	3444	msedge.exe	88
PID 3444 wrote to memory of 4224	3444	msedge.exe	88
PID 3444 wrote to memory of 4292	3444	msedge.exe	90
PID 3444 wrote to memory of 4292	3444	msedge.exe	90
PID 3444 wrote to memory of 4620	3444	msedge.exe	92
PID 3444 wrote to memory of 1040	3444	msedge.exe	93
PID 3444 wrote to memory of 4620	3444	msedge.exe	92
PID 3444 wrote to memory of 4620	3444	msedge.exe	92
PID 3444 wrote to memory of 1040	3444	msedge.exe	93
PID 3444 wrote to memory of 1040	3444	msedge.exe	93
PID 3444 wrote to memory of 4808	3444	msedge.exe	94
PID 3444 wrote to memory of 4808	3444	msedge.exe	94
PID 3444 wrote to memory of 4808	3444	msedge.exe	94
PID 3444 wrote to memory of 1560	3444	msedge.exe	95
PID 3444 wrote to memory of 1560	3444	msedge.exe	95
PID 3444 wrote to memory of 1560	3444	msedge.exe	95
PID 3444 wrote to memory of 364	3444	msedge.exe	97
PID 3444 wrote to memory of 364	3444	msedge.exe	97
PID 3444 wrote to memory of 364	3444	msedge.exe	97
PID 3444 wrote to memory of 1116	3444	msedge.exe	99
PID 3444 wrote to memory of 1116	3444	msedge.exe	99
PID 3444 wrote to memory of 1116	3444	msedge.exe	99
PID 3444 wrote to memory of 4400	3444	msedge.exe	101
PID 3444 wrote to memory of 4832	3444	msedge.exe	102
PID 3444 wrote to memory of 4832	3444	msedge.exe	102
PID 3444 wrote to memory of 1248	3444	msedge.exe	103
PID 3444 wrote to memory of 1248	3444	msedge.exe	103
PID 3444 wrote to memory of 2624	3444	msedge.exe	104
PID 3444 wrote to memory of 2624	3444	msedge.exe	104
PID 3444 wrote to memory of 2624	3444	msedge.exe	104
PID 3444 wrote to memory of 2504	3444	msedge.exe	114
PID 3444 wrote to memory of 4420	3444	msedge.exe	115
PID 3444 wrote to memory of 4460	3444	msedge.exe	116
PID 3444 wrote to memory of 4428	3444	msedge.exe	118
PID 3444 wrote to memory of 4428	3444	msedge.exe	118
PID 3444 wrote to memory of 4772	3444	msedge.exe	119
PID 3444 wrote to memory of 4772	3444	msedge.exe	119
PID 3444 wrote to memory of 4772	3444	msedge.exe	119
PID 3444 wrote to memory of 4420	3444	msedge.exe	120
PID 3444 wrote to memory of 4420	3444	msedge.exe	120
PID 3444 wrote to memory of 3552	3444	msedge.exe	121
PID 3444 wrote to memory of 3552	3444	msedge.exe	121
PID 3444 wrote to memory of 1776	3444	msedge.exe	122
PID 3444 wrote to memory of 1776	3444	msedge.exe	122
PID 3444 wrote to memory of 1776	3444	msedge.exe	122
PID 3444 wrote to memory of 3400	3444	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://planete-merket.eu
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbe146c188,0x7ffbe146c194,0x7ffbe146c1a0
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,2965020706612407096,15642259519531127612,262144 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,2018927828667198822,12213650115858710740,524288 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,4589976797780696569,10858942394175354513,524288 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,13913006352830986491,3948778704243750424,2097152 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,8493340640837122733,16003303831012317092,2097152 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,9972170950289683645,17841303928820019168,2097152 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,5397833320093707075,2311529694089572174,2097152 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3608,i,100406972926367621,4642400102190895901,2097152 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3708,i,4657004443600909635,5710395656086860912,2097152 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,13145192339298391778,9030792062295185812,524288 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,13145192339298391778,9030792062295185812,524288 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,7102631521719769481,9487052203949111281,524288 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,15833242270426508827,3989091829803266181,524288 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6252,i,16431064413192444649,3829390344094011170,2097152 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,6852414316789772443,571718955263037047,524288 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,14117294650182738665,9589302844842927156,524288 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,15273746175798965546,17114809327152037732,524288 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,2406871609494010393,11589071880936166380,524288 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5524,i,8385902795825668694,3322521242919538838,2097152 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,4666110834444595273,9579518652935798816,524288 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,3919915931581368506,8614390126406722683,524288 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5940,i,12002616119956721936,4148872174244162423,2097152 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6012,i,12437062878494037098,6948188579660283579,262144 --field-trial-handle=2340,i,5635829078158893641,7376284377677410783,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 7a8997eb800d84fcc0987b5817a6e2680c64bdf79811356541717400d5fb5025
MD5 6533c76bd299cf2c5dcb3e2892f82607
SHA1 617b4e8b56d56c011177f993a4f49a7aa7644729
SHA512 c79a59eeeb962a1ed7f1c8517b3ec72290e20b68243114fff259ba5a832578002413fb93f0e8f426087f2421eb3f913ed85cb324ce8ff4cb04b6241702f295bd
TLSH
T1F6E026C80DCDE22FE720658B927C874C82E0370E93CCED1A27288888B04185CFAF66D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 57e9bf08a51cfd76529ba7e719888c1e3390a09c149d3fc73dc88af160d071f9
MD5 6f1928fb90258aa870cb0ebd6be4e8df
SHA1 1786524aa362597f998bdd5484b911e095563629
SHA512 73dad12c7c128417cb824f9eb601dbbb134da85b16efad04014854a820cfc3e051f994658925eab1bcd6c12644c90ca808aa0010e24cd5133448070f9a09f291
TLSH
T104712C1A11F9489DD721A330F1CA1D1E7CF3F19B0E139E89315CD8BDA53A734E4A5454
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ba62.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ba62.TMP
Size 3KB
SHA256 1d02c57acd12aa3e154bd87b1cbed2e47be7e1f6852f42fad630c9118ebd612e
MD5 cb84df047c6d1beb22989d6121338719
SHA1 daa7c56b8b42f4bc79c1a089a632b26fefe4888b
SHA512 275cf8bbfaf91d7657bcaeff8b7b917f966e6286da5241777b8c58c86173d92ae185c62297f5bcebf2928d52f4cee895200e4375307171cc062f32074957b74b
TLSH
T1A9712B1A02FA489DD721A330F1DA1D1E7CF3E19B0E139E89319CC8BDA53A734E4A6458
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 453370de5654f5da12d571fc81a493eae68a53eaad5ed87e641505ac41403f30
MD5 272133225c3abe4b48b5657fe9e8ef79
SHA1 c3cfe3b073556c9a0ac5b01c057d147af1f6f2ae
SHA512 77cb8ed37c961447bd0fdc8ae43f502ca1fa4d039af4cde761f8348932051e5e23b41cdef64bf398c8c866496fd0f130f3d01dbfc0c571e1b44e4a233a437774
TLSH
T1EB117DB3C3D5856E8D0156F05A24EE1BCE2D0606421C7C5989D4EF67D3E3075E00195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fd8822601f07d139d9c646ff3b9888c8577abdac89e37b12f8de0763885c3318
MD5 1d94693b0ef4ace59f93d3583200a206
SHA1 e452a8b46ae22a9caf2bbab1696bbb8728ff8088
SHA512 db7ef3889cec54806357f8979414017a097ad593151b0a573dd7da9f70e7971e02fe4476a879fdf18422ecd30da4f715366878ea7f09a22d19c3b87af87640dd
SSDEEP 192:sxZIRmyM/jK1Ml8Mkz/f7sjr2ZMIdpnoHW6+WNGY4w0WiIgrJ:sxZIwMz/f7sjrKVoHbGf9
TLSH
T16C42E811AA346977CCDBD20DFA55BF53D6F91472A2900D44A9FCCA1C05E6AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 416e90b26006cd2d449d802c955126ee4a7de8c997fbf9cce9dbc768257e1693
MD5 2809a69ac4b3ebbb3794098cd297660d
SHA1 98c8a69ff28a04ad9d4859c40c0ce5bff454971a
SHA512 3ec16316ecc95ee645ac3a65aa342531acd0098df583d98e58cfd51014a5ade7a5fab3ae6dcd670b994a1e2da22b439dd4360f7a9c971a76b9eb8ff6b97520b1
SSDEEP 192:sxZIRmyM/jK1Ml8UQ/kz/f7s2r26MIdp1oHW6+WNGY4RRWiIg53J:sxZIwqsz/f7s2r1VqHbGFn
TLSH
T1E852F812AA745977CCDBD20DFA41BF53D6F55472A2900E44AAFCCA1C01E6BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a656a209773924cb1ff0348740eeff0663337041e294d576488b282aa9a6fb5e
MD5 7e026af76c0511e94305b4d4f398c79f
SHA1 4ebf40ba8e529d4e8d2405686f7a9feb199e4ce9
SHA512 1a7132145b3c24a108093193abb541db6be79506c24517cf395045469057dfb0c08249b5ee74e8f24ed3b70f4e886d12d40f22a694aa3ebcff50499692b72138
SSDEEP 768:MK8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdHro3k9Unt:MK8iJPNWvx76ru1jahALocdUaUt
TLSH
T108D2FA3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7df78a3e7255c910978d0d3df0fc48f0d5a1f5abc3462e4796d17654181a19a8
MD5 5a7c116736c43febba3046238e112714
SHA1 b2906b9da84be9225b34feea961b777d3fb82e29
SHA512 c8ef204df9693f9f15da59891e3bbabb028a085f3546966b8be3fd99bc3231d5bbcec81b556ec1e39dd19b06ace8062f786b22c580b0bd64afd428903432f484
SSDEEP 48:KsgIvKBWMPyNPK7/1pNkdpgPIgXkKDBbtkHf0aA1bTIRKwQUbyt:Ksg4KBW2qEgKNCuTqKwQ6K
TLSH
T10091411235BB16112C3E2D0CE25196566642B6B33208E96B3BF855F20E7BF650CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04b68861-3336-4024-b99c-3598db921a3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\04b68861-3336-4024-b99c-3598db921a3e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 c5f95065e6dc6b71bb1ba4a9dcdd7cf0724488a622ace7e50245e6a498660b9c
MD5 f7d0be7d6684815542804f1b8ceddf03
SHA1 becec12ec39961b7625666bd63fe52074a3cd59a
SHA512 b61d0731366a85941f552b056befddef84f9a6dea22eb61020666836e2670f0ef54f9dff50c62a1ee29f3098bb611607572ec817e930ee6e3cbd30a4c83dab97
SSDEEP 384:UiFiZcIYsNq8TUNTUlIl3vp5vW8kkTiDf+HBbsrvgoS:vFQY3wg1pwpfgGYV
TLSH
T12BA26C739CE8DC7BADB2DA55F94736134EB44067DAC8AF90E6D8661C01DB19C030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f19d3b578ba9a234458c2b9143a25683fc1c7cd3594ce9859d53d4e3ce5a7d51
MD5 3c80ce28108a7c79c18a42ebdc9c56d6
SHA1 b01e04f4baa3a1b8103c9d8c354dbf43dd01a838
SHA512 15e5604b9629c0bf20821d15af60cca6bdf0d59f182236893fb5af2a6438683d20b494629eaf7e08f50c20f8a9793865393623b17d5c5be102bdb59866767d87
SSDEEP 96:ZqONk1QsjpfmUTmDK5ih/cIPURHl8h4otop5g5DaBhPwivh50xy0SFYKCAxTeYNu:gONl6kDfQmiUyCKZ903plQi6ctU6
TLSH
T18902E935A8786CBB8EA3AE45F44737175FA4112BEAD42F85DAE81B1C04D764C170783B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e26273dc257ec312bc8012308620df1e7c62bb9f665a524a8eb590a3db9a3876
MD5 67cb30692dc833009c9b9e3645e314c5
SHA1 bfc770acf0a880ebb70f689465e0737c24db412e
SHA512 bdff253f845592e8c8dd1afa165b3058257d306cb79f96b1f4258a59428bafa57be6325a3ac46e934807cb767711931ae658cc43c6a7df1f72507fa2f6ac2e92
SSDEEP 192:jm+xasuheOwQxMGsNS0QI2QEmU+QmiU12Xz4k03pTeF3lLIpqK+HBHtn1bUtrvgV:AZcIhsNS0vp5vW8kkTiif+HBbsrvgoS
TLSH
T180827D729CB8AC7B9CF2D156F84736175E748027D7C82F90D5EC672C05DA6A8130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e8f1e77496ad49c98971afaf12e5c183a9eefd23c1bfb0b63602764a8e912d4
MD5 9f574db1f26b3ac275ac571ac314dab0
SHA1 a6a4c791559137fa9382736eaba7d4a3662d5451
SHA512 fb03a705bf05c2c34a8aa833c7ecaa8ffddc8944073e379bd2ad61503a845c29058672738c19aed0e714af2e3191178413c884f2e9d70bcd006e9264be58c227
SSDEEP 96:IqONkXQsjpfmUTaK5ih/cIPURHl8h4otop5gUDaBKPwivh50xy0SFYKCAxTeYNs2:TONz6k/QmiUyzKs903pTeF3qcRpqKU6
TLSH
T159122B32A8B87C7B8DE3A455F48736135EA5412BDB882F91DADC2B1C05DF25C130B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1f7741957884f4e955bfd1270d4be5cf479df0927a2ba761d1c722b5438bb1f4
MD5 9e9fff8c5d9fe06e977bcd08d8bd4271
SHA1 cf5fc2b6f0f456cd550015acf3167dba46cc258d
SHA512 11303b812988aa39ea2881e045509d49aef73bf4e7531a4b8101e112679b5dc2a3658d79524aac24b2829dc2442c632b521bd6d418e253e4c5efb800a4cbfda1
SSDEEP 192:ucm+xasuheOwQxMGsNS3QI2QEmU+QmiU12Xz4k03pTeF3lLIpqK+HBHtn1bUtrvM:qZcIhsNS3vp5vW8kkTiif+HBbsrvgoS
TLSH
T17A828E729CB8AC7B5CF2D156F94736174EB48027D7C82F90D5EC672C05DA6A8130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4a5a316-c01e-4138-922a-ac8729bb76f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c4a5a316-c01e-4138-922a-ac8729bb76f6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1dee3a100b3935d82e01bb4f5eece81583d318f36b05e14d4363258e821315ee
MD5 6652a34a48c48f841f9be99568c1158c
SHA1 9c2fc1032c84a565f6f92e7743fc1c3787be36c2
SHA512 b234323d4300322b7a1029e59644759d7f4d2219c42d06803d3f9e545076e4368d104be963437f6f776b24b49d3ea6b8b6585b9897a8c0de9e9f6512c4668db9
TLSH
T15441DB5866EE1144B3B76F56ABF6A86D487FBC372F4694AD00010D4E0663E41C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download