bf7bd52d7f441ee9a20fb8b4e08107917448a8235d3cf376bb02d7a0d1ee0341

Analysis

max time kernel
149s
max time network
159s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fritzing.0.8.7b.pc/parts/subparts/breadboard/0402-res.svg
Size 2KB
Sample260504-pgxfqaaz2s
SHA256 bf7bd52d7f441ee9a20fb8b4e08107917448a8235d3cf376bb02d7a0d1ee0341
MD5 33c57bacd6b928c1bc0064c2332cd928
SHA1 d27c8a88fad0dba34d8b3162f571c1ccf1265d3c
SHA512 e7e7617fdb57b1eb48a035ad2efb64f0ce7b15a2e2e68544db231cb7ddaf5bf31f64c3216651e23efe37924d8d122ed9b90e8c41690a259a0e23b2000a8dc56c
TLSH
T12B413398D348F0DCB15247AD9978DEDB620758C1232788EC860B363FB31B9976D6594C
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5656_1953980000\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1988	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3017107513"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31251417"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223708816276851"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{ED7ECD83-FFA4-4FD4-85BE-06DE4B6F9DB3}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5656	msedge.exe
5656	msedge.exe
5656	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5656	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 5656	4124	iexplore.exe	78
PID 5656 wrote to memory of 612	5656	msedge.exe	79
PID 5656 wrote to memory of 6020	5656	msedge.exe	80
PID 5656 wrote to memory of 1988	5656	msedge.exe	81
PID 5656 wrote to memory of 6020	5656	msedge.exe	80
PID 5656 wrote to memory of 6020	5656	msedge.exe	80
PID 5656 wrote to memory of 5600	5656	msedge.exe	82
PID 5656 wrote to memory of 5600	5656	msedge.exe	82
PID 5656 wrote to memory of 1364	5656	msedge.exe	84
PID 5656 wrote to memory of 1364	5656	msedge.exe	84
PID 5656 wrote to memory of 1364	5656	msedge.exe	84
PID 5656 wrote to memory of 6096	5656	msedge.exe	85
PID 5656 wrote to memory of 6096	5656	msedge.exe	85
PID 5656 wrote to memory of 6096	5656	msedge.exe	85
PID 5656 wrote to memory of 3952	5656	msedge.exe	87
PID 5656 wrote to memory of 3952	5656	msedge.exe	87
PID 5656 wrote to memory of 3948	5656	msedge.exe	88
PID 5656 wrote to memory of 3948	5656	msedge.exe	88
PID 5656 wrote to memory of 2968	5656	msedge.exe	89
PID 5656 wrote to memory of 912	5656	msedge.exe	91
PID 2968 wrote to memory of 5124	2968	msedge.exe	92
PID 5656 wrote to memory of 1192	5656	msedge.exe	95
PID 5656 wrote to memory of 2708	5656	msedge.exe	96
PID 5656 wrote to memory of 3188	5656	msedge.exe	97
PID 5656 wrote to memory of 488	5656	msedge.exe	98
PID 5656 wrote to memory of 488	5656	msedge.exe	98
PID 5656 wrote to memory of 1744	5656	msedge.exe	100
PID 5656 wrote to memory of 1744	5656	msedge.exe	100
PID 5656 wrote to memory of 744	5656	msedge.exe	101
PID 5656 wrote to memory of 744	5656	msedge.exe	101
PID 5656 wrote to memory of 772	5656	msedge.exe	102

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fritzing.0.8.7b.pc\parts\subparts\breadboard\0402-res.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/fritzing.0.8.7b.pc/parts/subparts/breadboard/0402-res.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ff899acc188,0x7ff899acc194,0x7ff899acc1a0
    3⤵
    PID:612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,13161238226616417485,9400946560204768666,262144 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,13882537898163643685,31925654899691149,524288 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,12844385674077332882,15427368603047682533,524288 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:13
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,10091975950635400257,18116174314968477489,2097152 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,11264787686252646133,3063930231229092066,2097152 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,16274680326767427129,2974343715960491914,524288 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
    3⤵
    PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,3069899277612315454,10165182111608148708,524288 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
    3⤵
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,3689048548667397449,9246370586766136462,524288 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,16505997821179648080,4735204105450788156,524288 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,16505997821179648080,4735204105450788156,524288 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
    3⤵
    PID:912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,11252921528661681363,15602832616321828514,524288 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,8006777558664875284,15556760901359867363,524288 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,6109141966037807539,11872051264186311035,524288 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,12843083181955361194,6643076180754274085,524288 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
    3⤵
    PID:488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,18091801455776533636,1743209698556341624,524288 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,6780871944467944145,10048612300146645060,524288 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
    3⤵
    PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5708,i,797245173451886395,7515858292852238824,262144 --field-trial-handle=2180,i,8076180173677760121,11274641323908526427,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:10
    3⤵
    PID:772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 23e269425dbc1568e880c8e14ee47f131671ed721743af458ff7c135c98d1097
MD5 2b684ad05fe07bc23b023797da8b12f6
SHA1 a4c902be50ad6e640d311cde82b95531aa106894
SHA512 481b7d1d30efca465b7b323a877fa3e91a8107837e610bd9eca30a7f30af62dcc85d1135cca06a453fd080fc715f0bac06d9821188cfb2dbbb72519faa86ab74
TLSH
T13DE02BAEC860AC374CFD47186048434AE75013571B81494F3A3CD10ECFB5727454BC6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dac97c56001be8128f0f464b85590f7d180af641f3a9248753e26803673e83cf
MD5 5d2b5043c880d1e4efb5fd89974acea9
SHA1 f8ea24b368b600f1184a2fa6c54b645a2642f9fb
SHA512 3c9ae8299bf0eed78cbfa82d8444fb1336a86101126bf10115cddeec163e99ce57895a450b5a95393d548bfc3a8fc1dbfa1dd01d231e22cfe89f843db823c853
TLSH
T1B931CDF383E4856E8A1196F0AB187E2FCE1D0511436C7D5A85E4AF1B93E3465E101A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4c91c01adc896f16a9c7102c2bb686e2da8903f4677cde3f65d172a3155091f5
MD5 aadf29cc6b64f5bc7c2d1a6a73f29668
SHA1 559f702e94127e52c6218b2e6ffae269a93fad51
SHA512 240790562b2f18266082402000e7630ab74377fc75b2f7d773bab49b5b10e1f3418cc456c57acf650a74d26446616146b0945a9729aed0a4e03d9f28060a03a1
SSDEEP 192:sxZGSRJyMqZ/K1Ml8UQdcvd/f6sH1cRhYMsILcmDzodpEF/W6+WNGY0lKaIPy/9y:sxZGSWqivd/f6sH1CFs3mYo/bG5B/h0p
TLSH
T15C72FA15AA389D778CD7D219FA45BF53D7F9116292940E4899FCCB0C04E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 50e2f8ca1b93d9404bf77dea783debe8ccee984204be98c0afefe9049457ff77
MD5 db4370cf26ce193aa7a48b67ab435ae9
SHA1 078063c76ab6427b3c5676d6c32872127f522e67
SHA512 b1fd1cacb0d5cd8a50e02f96202a4c94aa49a45ac691d0a68da395f111ca584cc99d113baa86299392fff4aa4ec0be00023c69c4b02bc60d0eca175f3c56b99d
SSDEEP 192:sxZGSRJyMqZ/K1Ml8Mcvd/f6sNRcRhYMsILcmDzodpEF/W6+WNGY0lAa/7y/9IgY:sxZGSW0vd/f6sNRCFs3mYo/bG5q/hjM
TLSH
T18B62FA156A385D778CD7D219FA45BF53D7F9156292844E48AAFCCB0C04EABED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 cfd944785915104f60f000336312c3b97582d5f6faa36e09c4db090c235aa61f
MD5 1bbf3790bd111365ce63db4197dd15e6
SHA1 a3b7c1f156a68fdd44c67e67da0695c00ce815a1
SHA512 2237e8c38862afe2939c0c0ddc582d69522de8bc81af7f55592b0c7106cd373270d02a2df2ffd2e3d00efc5f3c8b3f973883316c699c056b594b97401444949d
SSDEEP 768:EZN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3W7yZLli:EZN9b8PT24ZE/CuWRmCCQx6u1jaKW7y+
TLSH
T136031B3B280CCB7F4F804E9CDD26AE8E6DE801CB96988D9447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5b242fc0d8ce52c045cabdad835f6d4463e9052ba3f8dc17e2d872864d2eade7
MD5 d0190d53a2ab34215e6e2e1d42000dd3
SHA1 ec52b5ce100117967f33b4561f8ae21d4217a4e3
SHA512 4cff02c1348432d74aeb18560e8de76fd79703ccbd6fd8c42163439855e67abfe14ecb3ffbe89770eacc72d10cf084894d589cc04f4f4743c8c788bdb0723042
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZNdk:cdOlNXJjSSjroduZNdk
TLSH
T1CDB25D15713B13903EBD298A8594F4AF52C231633018E43B7BB954AA0F67E64DCFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 76fdcd74514453a674a6e6ef04ba1cbb2aba1759735f10f36041edbfe785fd7f
MD5 9de1c3c82d7f9f68afe18452822a01a8
SHA1 1ce7ac33adf7327fdd55a27846ddbc5fd1005b6f
SHA512 2e1bf4c800aaff910672c819cc8b3e92af704ff07f48956f1f684c5873fd594bf1e4383457b40f850e785fccb30c950f7d5fe8871a656a0581f76b51aa5eed73
SSDEEP 384:nCiFavqMg38NW8TUNTUlIxB4d4582K14fXKhx3dJeX5iU3Ra4ffrN1k+5vI+7:JFayv3BwgLa2HKHtZU3RaGf
TLSH
T1E2C23A35E899DAAB9DE64FC9E7097A03EFE001A7D59C4AD4DAD81D4D00C31DD130BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6d80c46b4720e2b83898e6c9be2388df435d8394646d25ae5b80f54e67671e36
MD5 c45e7ae19d02b16b06cf97bcd2d580c9
SHA1 0e5d6492641429189eb79b500cbe6a908cdc217f
SHA512 6a9875cbc08f96fad65d6c8bf597d5bfae609b77dbc075e777aad6f02c4fb144ee72194b62101f7007912d1b9e0a1e4929007118f751e83d8e8840f8dcdfa1c1
SSDEEP 384:nQiFrcXqnqR38ND8TUNTUlIR24d2cr914fXKhx3dJeX5JtXVXqFvvBrN1k+5vI+Y:rFzu34wg1wKHtWdVXqV1c
TLSH
T18CC23B36D8A9DD6BADDB4BC9F71A7643AEE01163858C4ED4D6D45E4C00C35DE230BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 884d115917d05e9063d1244d76e7a411d9009fb6fbbb5c66e6edeea2c1199ece
MD5 929c30d1c52d51e169213c79a5089e97
SHA1 b6d0f9edca09bb134ba1b3f95ffadfbf7e9fb086
SHA512 0383454749464654ecd6139795733771926357a1dc99004f1e144e5c0d117d91e4d7f1fc7b92addc71f8739c929eab835b30835d9b49fa3e199b7307fd80dc49
SSDEEP 384:nCiFacXqnu38ND8TUNTUlIRq4d2Jr98aVftQYQdhx3dJeX5JtX+XqFvvBrN1k+5E:JFYu34wgIZnQYQdHtWd+XqV1c
TLSH
T159D24B36D899CD6BACDB4AC5F71B7643AEF0126399884ED4D6C45E4C04C36DE230BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 60e988ecc8583c2c2499cece729f0b13c0360900ee7a93937ac06e9276c7dbeb
MD5 de10b205496d337e820815ea2c1089c0
SHA1 40000d58f80f555121561857db7a9038855e674f
SHA512 7571b55fb4e9f6c67faf2651ae8844db82d3ddb667505b0788c6704d02da222b63f2dfd068b8660af0f5e4576200990e4347a70132e6f271c7dbc70c30410863
SSDEEP 384:nMiFacXqnU38ND8TUNTUlIRq4d2Jr914fXKhx3dJeX5JtXVXqFvvBrN1k+5vI+Y:3FYU34wgIwKHtWdVXqV1c
TLSH
T182C23B36D8A9DD6BADDB4BC9F71A7643AEE01163858C4ED4D6D45E4C00C36DE130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c4f7c1d807cba37b1cca9d935666e03196a1befcbe8f5121eb0ed764281ad237
MD5 c6ed164614018ac6e38fbc4210f9a954
SHA1 233ead4b188ae60f80df3fdf4f5f0f4294962b55
SHA512 209ad5a4693950d320bd7e67f74fac59877069820ccb17b18c00a9a0a77941738cdadf61ba98b9e7a70989b31a9c6141b2ca30d16e894eae85869ac7b97b50b3
SSDEEP 384:nQiFacXqnU38ND8TUNTUlIRq4d2Jr914fXKhx3dJeX5JtXVXqFvvBrN1k+5vI+Y:rFYU34wgIwKHtWdVXqV1c
TLSH
T133C23B36D8A9DD6BADDB4BC9F71A7643AEE01163858C4ED4D6D45E4C00C35DE230BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b98b8c4685bc829d3262fe86f3465669e0ae39367d449708543608ca668c6684
MD5 457718ab61f3c1ecb3fd709d4113f02a
SHA1 2f1e56a793b38fb92fb74d63ae24e12fd055cbe8
SHA512 050b4e439218aaf72e4d7c524d27245bce91ad925e5a254c97bd363eca74996d1775ebafeb5941402f690fe18a70798c5042279fe9b45ae3d9adf2a69d95d8f6
SSDEEP 384:nmiFavqMg38NX8TUNTUlIxB4dntu14fXKhx3dJeX5JtXiX3Ra4ffrN1k+5vI+7:NFayv3IwgmzKHtWdiX3RaGf
TLSH
T1B0C24B36E859DEABACEA4BD9E7497643EEE001A3D98C4ED4DAD81D4D00C71DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3a013b392a2498a6ee58f8139b2d2bbb3d1bbe58be6e28602f449519520fe49f
MD5 168adaccc39a8117e1fb87d3e794a40b
SHA1 0f7b7b5812de8fefc4fbef5f1ee16bc11b483f4a
SHA512 a8963e3c1a48ce0284bb7ee1fcdd5afd2b4bd96e8020c90a6009897ce7cc79b38871e25f61a8e98a0293e747fc7e43c9a68adc069c91ee8d7b21bceaa61fba56
TLSH
T1F2413ED18C3E66D2D4FD0E2E609B38FC95D8D729F4B4347D5868EA94063A51D644043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-35-0x0000018E5A460000-0x0000018E5A50F000-memory.dmp

Download

memory/5124-63-0x000002AD7F9D0000-0x000002AD7FA7F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads