hxxps://use[.]typekit[.]net/onr8tbr[.]css

Analysis

user interaction
yes
max time kernel
269s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://use.typekit.net/onr8tbr.css
Sample260924-cmdvcaxhmd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4916	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346894869347940"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{B7091A50-2DE2-4C27-938A-902AA88316CD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3292	3496	msedge.exe	85
PID 3496 wrote to memory of 4916	3496	msedge.exe	86
PID 3496 wrote to memory of 2888	3496	msedge.exe	87
PID 3496 wrote to memory of 2888	3496	msedge.exe	87
PID 3496 wrote to memory of 2888	3496	msedge.exe	87
PID 3496 wrote to memory of 1452	3496	msedge.exe	88
PID 3496 wrote to memory of 1452	3496	msedge.exe	88
PID 3496 wrote to memory of 4392	3496	msedge.exe	90
PID 3496 wrote to memory of 4392	3496	msedge.exe	90
PID 3496 wrote to memory of 1968	3496	msedge.exe	91
PID 3496 wrote to memory of 4392	3496	msedge.exe	90
PID 3496 wrote to memory of 1968	3496	msedge.exe	91
PID 3496 wrote to memory of 1968	3496	msedge.exe	91
PID 3496 wrote to memory of 4928	3496	msedge.exe	92
PID 3496 wrote to memory of 4928	3496	msedge.exe	92
PID 3496 wrote to memory of 4928	3496	msedge.exe	92
PID 3496 wrote to memory of 3688	3496	msedge.exe	93
PID 3496 wrote to memory of 3688	3496	msedge.exe	93
PID 3496 wrote to memory of 3688	3496	msedge.exe	93
PID 3496 wrote to memory of 4204	3496	msedge.exe	98
PID 3496 wrote to memory of 1868	3496	msedge.exe	99
PID 3496 wrote to memory of 4204	3496	msedge.exe	98
PID 3496 wrote to memory of 1868	3496	msedge.exe	99
PID 3496 wrote to memory of 4656	3496	msedge.exe	103
PID 3496 wrote to memory of 1848	3496	msedge.exe	115
PID 3496 wrote to memory of 3624	3496	msedge.exe	116
PID 3496 wrote to memory of 3280	3496	msedge.exe	117
PID 3496 wrote to memory of 3756	3496	msedge.exe	126
PID 3496 wrote to memory of 3756	3496	msedge.exe	126
PID 3496 wrote to memory of 1748	3496	msedge.exe	128
PID 3496 wrote to memory of 1748	3496	msedge.exe	128
PID 3496 wrote to memory of 1280	3496	msedge.exe	132
PID 3496 wrote to memory of 3548	3496	msedge.exe	134
PID 3496 wrote to memory of 4880	3496	msedge.exe	133
PID 3496 wrote to memory of 3548	3496	msedge.exe	134
PID 3496 wrote to memory of 4880	3496	msedge.exe	133
PID 3496 wrote to memory of 1132	3496	msedge.exe	135
PID 3496 wrote to memory of 1132	3496	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://use.typekit.net/onr8tbr.css
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa227ac188,0x7ffa227ac194,0x7ffa227ac1a0
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,5880488740534766199,13695723432925930630,524288 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1832,i,8976813065015770234,9835990440496745882,262144 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,12167267447177611721,15756453791874079652,524288 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,7818304220238234945,17154519858366807008,2097152 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,17682554743966056355,5929250121965479782,2097152 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,6234016616720742673,9023912103294341821,2097152 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,5432217839751822599,13639796468068580527,2097152 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,9324151633487213677,16417020495239497059,524288 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,6640475940559730647,15444039157856795826,524288 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,8639085913389697265,4834385708081311988,524288 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,8639085913389697265,4834385708081311988,524288 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,6163730862399922497,32652471398279554,524288 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,7133588408647483484,1392161240214648057,524288 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,228505256856506636,1531533120272623263,524288 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,5665362866218960737,15851602037846752259,524288 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,13249591769954689377,244805412140099870,524288 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5692,i,15394505279884668468,5376268087744809359,262144 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,516268424358576044,3719003897799069017,524288 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1036,i,11205121645737092462,13160768334452399439,524288 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=1032 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,4175168205870187756,4959550278402620876,524288 --field-trial-handle=2328,i,17886872296868959262,14862475043800599731,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6bff0f027b4593220ead05713bffd7b3d5423f6191a2524fd76dd83ff0eb23f
MD5 30591b0f3de624921162fd3a45ebe21b
SHA1 1875648c4ccd30a3e9006368fd4fa2368d87828f
SHA512 597d1be49f44efaefee912dc403509ac948d2981ce2a8c8038290e6f3e098f8b373930b866b23d4fd25432dcc9ac6f1d6e1bb26298fd76bf73c91db3821a921c
TLSH
T108D02BF899C80510C08230792137824133D9E6108103200990E107040C103A31200460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ef3b734c787633afe5b1c08a8ef08bde9d8879f31c826caf2e652aa614df86d
MD5 f6bf3c2e07439d9cb62d723d60e7ac3a
SHA1 572358d019a9f66b124eee416f35ea7195ac64bd
SHA512 f50fcdc5af36ec0684d7e4bcb343b9b713dea31b4539d18b949e37972279e41e6475068981ccee1ded1bb56eabade7faecbd57382d87939c090e6bc1fe3826cc
TLSH
T1CDD02BF859C80910C48230792136824133D9E6108103210A90E107040C113E31200460
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b5ca885ef47d5099e845fed729753d1e332e86fb38f627b9a6f6b4a5a55f0763
MD5 0eae9d3b9b2d885b794aa5a4362a04b3
SHA1 efee4bc5ba4ec44859d165735aa71202fa227de4
SHA512 faf655b3bc61cc845d695e6f61136a213330ee8f52656016e4a35a9111a3377a39dfb26ca64086ba1ab5bd7356beb480661a6c7d60147921a631b5db0295abdb
TLSH
T143E020EC05CDC21D515464C7C7B4874CD180370E93FCAB25271484CC704385477895D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d62e954d6273aab941a0f2bee4a482f10175f067127bea36bf2807d7ac151e9b
MD5 510e42a40b082093466548ea9d30233f
SHA1 24f3e72b45fdfc5b80e0822b95801f10317f47b6
SHA512 298f06a40aefed256e42c9528d25fab1746361a1f46a6821142a12b226d10c3fa79fa8b8dfad7c14b1186f4348bd17b006895398b17f8504a7517b9a125cecc3
TLSH
T1AB612D07A592E1D3FBDADA354CC3A2A7B230E68DD6861E138DA0D878F446FB050442CE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58db57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58db57.TMP
Size 3KB
SHA256 5a1ee33cfc31669b5620cf6469dee674c213f1502379551ce3994d11bb587a1c
MD5 8db33347d40a787100a0ecd35626f77f
SHA1 240acc9aad60aeefc4a62130ebdaa99d7dce4521
SHA512 93d567180ddcf3327246db15d3b6a3ad0eff0c69f361fd9479632c14fdd919091198d0fcdee2857e4f691962561661cc32dda31e5b1cef7895ce5c7c3fc5958b
TLSH
T134613E07A592E1D3FBDADA354CD7A267B230E68DD6861E138DA0C878F446FB050442CE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8471815e27a353f2390b3c839bdd2a1c398af5b7bc8d4521d46418d95c40649b
MD5 505f0feb4ed74f9e8acdb6ba2b85656a
SHA1 959ea0c474446d840f567b8e82ebe03d1b6dce76
SHA512 4c5b116d3a2ddf211fa7cad2af76f33d73b64580f1d37a8ea090bb3ba330cea337f53ad97edc90867be6c7dc24d2d116a958f2c7962074605bdbcbf1cff00361
TLSH
T17B116AF3C3E5856EC90156F06A18AE1BCE6C0505471C7C6AC5E4EF2BD3E3475E10195B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1dbd64f83938ec924e5a52c2cca85d7784272e91990ef08d0d0887b012d07764
MD5 eba001087af3c413ec9ceebc144b430f
SHA1 a6a8c8ef689fe49a984fdfbd3cb7803d394fde12
SHA512 da0c863ffbe252648720ee4a2f04581dd7f7ad67325936f8cbe341f8a2191b336128d77e7e932d1021c3cc9a42dd932d5bd478a57015bd24021a8077781bf63f
SSDEEP 192:sxZ4RfWe/fLsZgjIdp2ZHW6+WNwmj/YRPBnzIgrJ:sxZ4oe/fLsa8+Hbt/mp9
TLSH
T1EF22B8526E38A97B8CCBD20DBA15BF53E6F95032A1941E48AAFC871C05E66DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f5c04610f2829c4ee803d1347a4714fbaedf80e6744785d442ab4927ccb331bd
MD5 21be50d01c808053d3638fdff0b42847
SHA1 dc00a5aebb12abccf0441ddcd0d9d291cd96fa19
SHA512 76f6206df6fc92bcd93aeb737285774fb83dd0dfb5b4912e2035478635bf3e75b3516cb65ab23192d2f44ff421144f3e05bbb098514c2935050c22c4c6aaeeca
SSDEEP 192:sxZXRfWe/fLsCQjIYvgp2ZHW6+WNwZVXYRPPnzIg5XJ:sxZXoe/fLsN74+HbUXmLL
TLSH
T1A022EA566E3469778CCBE60DBA19BF53E6F5503261901E48AAFC871C15E76CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 98dab2733918b8f9a69534e7583077912da769378ed087cd7541f2f959185020
MD5 916dff80ae26cb16a308496cff5b8be5
SHA1 cbebf378cb2df88e99443abd189c1912bb9fa4c6
SHA512 cc8a15c62c98a79c0704acdcdbcfe49af55c9bd93a26921464f90f7c03ab7013ec573126f7c0136caea98ae41f48a91464a0d4f6a967d7440a1bfe91be1aca83
SSDEEP 192:sxZ4RfWe/fLsCgjIdp2ZHW6+WNwmj/YRPBnzIg59J:sxZ4oe/fLsJ8+Hbt/mpl
TLSH
T1D422D9566E38A97B8CCBD20DBA55BF53E6F95032A1D01E48AAFC871C05E66DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 93b21aca510599793cc226687fee317f37420194fd1d066e0ce8869d8813c4b0
MD5 e11c0f74a18610dde58633b7d2daab25
SHA1 b3239f48e31b784842e0b179e6ee6a8899ca408b
SHA512 e3dc0c9b76215b5b02e03b2263d679e975d4811ac608c90c91f9bd7d59f3477aa5c592ded3c0c9817266e78f0a16d125946d0d8d1c1734210aae2eb7602fe7e1
SSDEEP 768:GEK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3Jrox+E9:GEK9uzYWvcQWsu1ja0HL7Q3ix+E9
TLSH
T1EDC2093F640DCB7E4FC01A9DDC5A6F973E9802D7A6688D4047FA984C02C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a291dc143e0a072cba812efbafa7860c538b2168af2c2d3062c3005ac7740730
MD5 5ea452075d60d7ebc9b9387eae72e4a8
SHA1 a50e990ab33538ca50461dfcaf2ae30b49df36b0
SHA512 34387e4580d913ca327619c54e30f277d82c238583dad37c0c2a0c4168a9e00668e7bad4a30f82e1ce3058450702cd6ea0747d2fec608f5ff407d14b97d0de5b
SSDEEP 96:K0mBIIKpyWK4IK5SOzufTltt+T9olVz+KNLVx+pL:17n+m
TLSH
T15D91288531BB020078BD795C81A4976F458171B33128EA2BBFBC50B19E6EE185DFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1336d6d-80bc-4b49-a217-f1bb06ada044.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b1336d6d-80bc-4b49-a217-f1bb06ada044.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ae8a83b454f6228419562cf8efa0c4e8fbd8fdd017c4c4f3faf53c049bb383a0
MD5 80251812c2f160c90b10cd74bf719241
SHA1 fd53e6984d9de9e750b2d7fd775058f82beae7e3
SHA512 58d8150977bb941466daa65ccf90f5ab4421fc9115c5adc6afda0f2eb8ff7784c1837334e884919a2e7704970d03e624991aa594aab313a867443415c8c4046c
SSDEEP 384:xiFiZcITzsNh8TUNTUlIlYw/ryqKtLOjTVFDOmxjiwJr940/upa7dLKkdgok:YFQ3QwgPryZanjOyjJh940Sa7dLKkG3
TLSH
T1FFC229F24CE74976D9AE9747A73D2D039EBCC0A7B5456A80B3985A0DCC961BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d8bb724a4b162f0be74d28b79197a6c2918518b376a2ed43a2459cda9f6c2aea
MD5 83b0fa65897cbfbe04eedcbf680c006b
SHA1 9224be401e1224308451497cea0e0a3b3dc973cf
SHA512 09705848b488139b29867f5439fdc63f95390d9094b24ec8776937a04f00ea3c6d709837ce360a764aa894b4f142ae217a336c5ca400dc1d8321413f9977c87a
SSDEEP 192:SONJ6ygpQmiUy37tOCTVg+DO9m9zPRtU6:SONJ6lHGtOCTVFDOcrU6
TLSH
T1BB02C734BC682CB79EA36E45F58B27139FA4116BDA552F84DAE81E1C01D769C2307C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b839139f5d030d4df80668ad69afefa91de8de623f28056fc6634c206edcde17
MD5 3a9d0f8f5d195d5b3d1ac82e0cae04c3
SHA1 e47a887bf50fde5b00d0bed75ec4bfdd01f12197
SHA512 405917f4bf177df726505778756c25fcf3e11890d8f7a19de5148e7cb7ace9382b730fc34fb4e527729b7d1c20e323744ed60589ccffbe610a5405461c9cfe1d
SSDEEP 384:UZcIhsN/Fw/ryqKcLOjTVFDOmxjiwJrF40/upa7dLKkdgok:ShfrywanjOyjJhF40Sa7dLKkG3
TLSH
T12F828D765C786DB259FBA244F84735039FB880A7DA896F84D4ED5F0E01EA6DC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 115b12578ec034be6285f8ffb2c53045b97cad0a31a65cb8b60083cadcfecd57
MD5 a029db2bf4ef5ee258566049e9d4736c
SHA1 ecbe4eb41154a156f3a207202ef73156956bf89b
SHA512 5dd6f74df70ee75cf98171a3e0610d831bb06f3194620287579860cbe8580087fc7a1ef61be8e46c3c56e587a67ab8db3c463a9d293e7b79d8b4154616b8f39c
SSDEEP 192:SONS6yKQmiUyy7JOCTVg+DO9mXxjv2FJSJr13U/+/fU6:SONS6dRJOCTVFDOmxjiwJr24U6
TLSH
T159121935BC786C775DA3A585F48736139EA84167DA4A3F80D5EC2F1C01EB6AC230BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 764e4c1e872f45fe45c91cb95c7dac3b35db8173f5d1b788e1595158358578ba
MD5 8b251d763a6042a90ed19fcdd7e059f7
SHA1 57ece5a59fec6d36a336b34f838ff6a8b02c8a1d
SHA512 a9182397c46fe6e83caff23ae00026965afb67412ba0c0e4ee2d711bad11c5dfa42df3dea9d3908cb602f6e46ce5af5e8cb0189ccca957c388633515fa4e0565
SSDEEP 384:rZcIhsN/Yw/ryqKcLOjTVFDOmxjiwJrF40/upa7dLKkdgok:zhkrywanjOyjJhF40Sa7dLKkG3
TLSH
T118828D765C786DB259FBA244F84735039FB880ABDA896F84D4ED5F0E01EA6DC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2109e8e63ce71a9b7fbc82e72651751df9370eab511ad057cd23bda2965dc287
MD5 a644a81a500db1387cb76055d325023a
SHA1 0e88e2c8377d15647c8efa334750060aa691cfca
SHA512 4e80a00ab54a4dc0e6d5a5d8db38f7214cb00415acf7431fa2b082220c1e6183ada3b6e6b1e980c8dc1c03ad0cd4fb58a41e237907767c647c94fb60f4eb9438
TLSH
T14541F858BAFE1148B7B66E16AFF6696E487E79772E06D45E00110E4F0A23F00C971B37
MD5 SHA1 SHA512 TLSH

Submit Download