009e29a73d921a7fb36737b4819d32ab82ce7a51f52c68b62c0897fd6aaeded5

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
08/05/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pgnviewer/vega.html
Size 4KB
Sample260508-pkg57scv3p
SHA256 009e29a73d921a7fb36737b4819d32ab82ce7a51f52c68b62c0897fd6aaeded5
MD5 6c52d3a5fd56c2b6e175cdd2a0c1c9ba
SHA1 6301a99c0a540da3b1459f756720f7af3a07d53b
SHA512 ceb427472eec552564e0722905231bf06b74953d42db9cd96f35abfdd3c987c2df47b5e03b83e8be4a652678b2ae45db420e98071a6828b23030a25d3864e1c3
SSDEEP 96:pKymbVtHUvZAZFUSrV2IlbwJLZFUoutyoAo5c5yTrhWuvT4qvPUT2:paVBYumE8Xktrc5h47PUa
TLSH
T1BC91B60E8C275C2191728178D5D5F25CE7624A8F8312AD62B49C903B7F7870F99ABDEC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\ta\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3264_883599389\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3264_2005332098\_locales\gu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227190528910258"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3534313381-4287935181-1066995225-1000\{50D7EB17-1799-4BB7-AD33-0E31B6412309}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 5884	3264	msedge.exe	78
PID 3264 wrote to memory of 3988	3264	msedge.exe	79
PID 3264 wrote to memory of 4436	3264	msedge.exe	80
PID 3264 wrote to memory of 2304	3264	msedge.exe	81
PID 3264 wrote to memory of 4436	3264	msedge.exe	80
PID 3264 wrote to memory of 4436	3264	msedge.exe	80
PID 3264 wrote to memory of 2304	3264	msedge.exe	81
PID 3264 wrote to memory of 6104	3264	msedge.exe	84
PID 3264 wrote to memory of 6104	3264	msedge.exe	84
PID 3264 wrote to memory of 5232	3264	msedge.exe	85
PID 3264 wrote to memory of 6104	3264	msedge.exe	84
PID 3264 wrote to memory of 5232	3264	msedge.exe	85
PID 3264 wrote to memory of 5232	3264	msedge.exe	85
PID 3264 wrote to memory of 3580	3264	msedge.exe	86
PID 3264 wrote to memory of 4360	3264	msedge.exe	87
PID 3264 wrote to memory of 3580	3264	msedge.exe	86
PID 3264 wrote to memory of 4360	3264	msedge.exe	87
PID 3264 wrote to memory of 2984	3264	msedge.exe	88
PID 3264 wrote to memory of 5020	3264	msedge.exe	90
PID 2984 wrote to memory of 5220	2984	msedge.exe	91
PID 3264 wrote to memory of 2700	3264	msedge.exe	92
PID 3264 wrote to memory of 2700	3264	msedge.exe	92
PID 3264 wrote to memory of 5612	3264	msedge.exe	93
PID 3264 wrote to memory of 5612	3264	msedge.exe	93
PID 3264 wrote to memory of 2652	3264	msedge.exe	95
PID 3264 wrote to memory of 2652	3264	msedge.exe	95
PID 3264 wrote to memory of 4588	3264	msedge.exe	97
PID 3264 wrote to memory of 5776	3264	msedge.exe	98
PID 3264 wrote to memory of 5556	3264	msedge.exe	99
PID 3264 wrote to memory of 2200	3264	msedge.exe	100
PID 3264 wrote to memory of 2200	3264	msedge.exe	100
PID 3264 wrote to memory of 1992	3264	msedge.exe	103
PID 3264 wrote to memory of 1992	3264	msedge.exe	103
PID 3264 wrote to memory of 1352	3264	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\pgnviewer\vega.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ff84549f208,0x7ff84549f214,0x7ff84549f220
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1844,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2124,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2324,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:13
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3432,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3484,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4172,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=3436,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5464,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5516,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5516,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5792,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6028,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6204,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6320,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5484,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6112,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4968,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:14
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6288,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5956,i,8438993696139418102,1618426385681649603,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:10
  2⤵
  PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d42af73b53ac9ac969b2a7847dd50295d23541efbe3e7a201d570995913f736f
MD5 b0d76937840f1bf3341ad1a83cd7935a
SHA1 5eea9891f9df35b3b3aa69f1366b7c5b0def5f2b
SHA512 9021c5e31c1ec851307517c747c7f33c132c434fc1c18369c6bba2cee4993e2fe2635023f6f80f03a9f22bd3c4f7ed71548282f877baf476a6f52c215281702e
TLSH
T1C2D099A33F28A282E08A08B0A3320AC8AB008080300002E8CA020808280B2C22EF80EC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 12e9cd1d77c6efaa13c23e5fba437bfb447a002c849ff7bd0b2278f158dd41c2
MD5 d31861c7f12db4387e73cb965ff789f9
SHA1 092387751595ab7bc278d4a93d3ea59045220335
SHA512 e08837effc86fe52fce16a1fbbd0f18d8c5501e9205079c3f364d007e7868bc9dce5ff1170d8e1f87fa62eec06a3f63a1917d54b79eef38e9550433c79fb069d
SSDEEP 1536:IfEEvnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BkHSRhPjU1
TLSH
T1FAB35327D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 919e299c9ee2c45dbf8cfb4233ddb66527bca557248df8823afe7c74fa23cda3
MD5 66619c013ef19b1a90a77c5a14b0d6e9
SHA1 abe826fc527dbfcbcbf57ee0935a0e3e527ab6c4
SHA512 d815ec7be05ee079a2d59e300d985072697d8757ad932bc84a2830596c0ef42dae50bb6c2ee88337ae2ddcc9663879e0670487a21b11d1416ade22bc79a289bd
TLSH
T10641D0F7C3E8456ECA4195F42A28BE2FCE1D0510432C7E9A89D4EF5B93E2471E24195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b917d62b-0ef4-4056-a20e-833c90dffb1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b917d62b-0ef4-4056-a20e-833c90dffb1f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 40b00da45a892117b9900a7c07d957c03ffaccc73bae86806a6d38591ff805a1
MD5 e0ea477da6b57fea79bfef7e5618ed8f
SHA1 3d5adbf7a70e26ff33af79a2427a028fefc77fcd
SHA512 44a2e6ba9a6905e529c047ea2e40fd7d68b98af66a2e803f3e18e80613570fe0ba995f57d80f08c4e42d9a70a64dffc76c40c50d73398ba6fa7e338ef4586e85
SSDEEP 192:sVdRiyMh/Ky0Ml8UQO3PceXsws47wWk4OhzhK9zoZ8p0a/Y+WNrY0H7efeIIImj2:sVdiLquPcIsPKgPhsB5/Sr5geIIIIq00
TLSH
T14072EA196A68597B8CDBD618F9427B93D7FC1473A2804E44A9FCCF1C00E6AED211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c527be966836087f31dde4e857e416f40705802d893ea3ca1f0e891fccd3adbc
MD5 909821fd13ce6a97fc629c7d8dc930eb
SHA1 9d882866c8f3b4ab4ee21a21d4f7c46c6263c5e0
SHA512 294231b7b5b97abd97d19a55315d98afd63b9f4e7c5dc88bdf51fec5f3830f10a1c2e1d37ce62cc7e599cf6fa203d7f72f3ba1a2f1581cc849e5c992cb6b2392
SSDEEP 192:sVdRiyMh/Ky0Ml8M3PceXsws4qwWk4OhzhK9zoZ8p0a/Y+WNrY0H6SBneeIIImjx:sVdiLPPcIsPTgPhsB5/Sr5a1eIIIIqj0
TLSH
T12962D9196A68597B8CDBD608F9427B63D7F82573A2804E44ADFCCF1C00E6AED211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 8245f7034d61ace99d94295d853505db9a565c686a16555d6962f165f6325b88
MD5 67bf905eb3764d3e3af63a6ec5f01b3b
SHA1 2974f576cf5be052117ec908ed433352c5fce542
SHA512 6901e7e1f4819c8ba81bfbdd88038ff101a8edf2dfd304640410ea49f5383968b455a423ad862a132014acff7e0c107ddfd3a3d5c5524d6bb7452cce777bc99b
SSDEEP 768:sgnrwBw8rE2Xp7pL/Ln3LWRWLFQn58F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Wa1q5:sgnrwBw8rE2X/Dn3LWRWLFQn5u1jaKWB
TLSH
T145031D3B284CCB7E4F805E9CDC2ABE9B5DD8018B9698895447FE840C03D66EF451B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 c4662bf7b1910fe25b90f52e3eb8de5009c189b9a9bbe272dc3d4dfad3982c32
MD5 d53f62316dd577d622cdcec53e1f77b5
SHA1 319001273dc44081c667e8ec1cf1546dc8f09081
SHA512 0092e4daf622c0126e04ddda6317d707d79ce3e1ebd28929eb24653713b9b12c697e0d2f0556c10c111339150af085e4db208c51b95fe41d427e414738c99678
SSDEEP 96:NNKL26KmxKDG+K6rKvuIKfQKNS9mZdTbL2lb8dd2Kjff90P04RAv7ZLvzwf+LTz+:kg6iS9mZdTbLQb8ddtff90P0ihSh0j
TLSH
T196A20635703E220C387D2A5871B8916F965260A36050A4EB7AA970E6CF67E305DFDCFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 460B
SHA256 f9f05c9df7cbf2901660f605dd5fdc6b4b9e125721b703d196f9cf4b3ffa9a3d
MD5 e9a13e0ede108a04ecc4e75c1fa2e022
SHA1 284718ff77bcfe005bc98bd86e95ffd243cf4a59
SHA512 bbbeaa31521fc3c30cae3cbdd011cda4c49567148cd030ea7a939f17afec9eba2694981a68440bac931ad38b0721285d06be4337beefe850a4af132f24cac9c5
TLSH
T103F0AB5B881B3DAB09722124452616E0FF68131F454A648E3BBC004C1F7A83A0ACBA66
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 7edf0ee1f7668b995dfd4317c298fe2c9f380aea867c442434500d56b9c8290e
MD5 69c52429285c9e6240eca1bb5a9700aa
SHA1 d4a70110f83fe06783eceb1ca9427adf84d4d514
SHA512 4ae54e6af97cde362b4d40cf178bafa456350c371debd0a697162136b9ddb1a14e74829912f988ffb08eecf8e53656df5e906a3775c0534a2f6ca420bfedb594
SSDEEP 768:VFj0raxyp4sQe6WGfvo3/CgoV0lni0u5zuXp6pQCUkToE1TovGqsW7iIKu8fqGoK:cb0e8fw3cV0li7BBUyoE1TWGeiAhGB
TLSH
T1AE13A03A58E49EA36CF68F8AE75A3617BFF01097DACC0BC4D5D45E0E008358D174B86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 de73b61109b85fad85d184a046a77c7078ad297546c8ea0ab0de2e7513334454
MD5 ea178620381e78344b19af6fba317a40
SHA1 d9fa9a529fc060843e653f800939b29a6d57df2c
SHA512 f0264d6dd3eaed2f2cf330eeea601630eda24c7fea7fd19f61119b3bd0b7c517394e8c55978f89e0b0468fbb784fe8437fc8232a108cf39e79ffb4fc1b9bf46d
SSDEEP 768:yFiE6esE8lDldUGz3UCg6l6oA0u5zuge6JCgEoXovGqsW7iIKu8fqGotE184r:TeB85d73nl6L7Q68gRXWGeiAhGiE1L
TLSH
T1D9037C3DDC84CD7B28DE9B48930E366BAEE011B7D5684BC8D7C84F0E10A6059F74B965
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 2c17d72009562765f63d8181d7f67cf46dae8c8434921dbc6b33b2aa85eaea0a
MD5 b81b88c8de8a8bcc4dd58a4b58002d71
SHA1 af62625bd426c07fe3beb44427a85ec7fd732b86
SHA512 acb7e6419baef260a2448e1c0d72f3331ffc2862f2b283fb1a7b9bdcd2a2be6568446615bc7e2414862c62ec15421ff02fc3c37a05f5edd6fe2f813b99857d39
SSDEEP 768:2F90raxyp4sQe6WGfv03/CgoV0lri0u5zuXp6pQCUFToE1TovGqsW7iIKu8fqGoK:fb0e8f83cV0le7BBUtoE1TWGeiAhGB
TLSH
T18C13A03A58E49EA36CF58F8AE75A3517BFF01097DACC0BC4D5D45E0E008358D174B86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 2d24e0401d27062861903f21b81c8e426d465db0f7eeb8213150a218fa2b4a04
MD5 e2cd0acf4a0f951fe6f5f41beedc6c8e
SHA1 2b067fe74605e4313c63ee276b834c63eea34945
SHA512 9a21ce0777f21f7a431d5d530a40125bd274959df8dae8ec9840b204670b506cb6f875e4ca9f853d1bdfb34b3bd7f98dcd5abe39ef63e338d983e6a791bab4f5
SSDEEP 768:2Fj0raxyp4sQe6WGfvW3/CgoV0lni0u5zuXp6pQCUFToE1TovGqsW7iIKu8fqGoK:Pb0e8fe3cV0li7BBUtoE1TWGeiAhGB
TLSH
T11713A03A58E49EA36CF68F8AE75A3657BFF01097DACC0BC4D5D45E0E008358D174B86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 449cb0391bcf65d690c06b6faf39c2ca1cba3fa101ebd1400b5da1055d65af1e
MD5 f182417e21a3d1181bc8a2c352c10507
SHA1 f14621fbd6060c170f16f0ee8ce8b6df7d8d8986
SHA512 eeb4fbdb66b11d0ff211c88dacdc86beda82b6c82d7272ebece5d194a4e14108b5cded70f8cf224f86ad417e1f104b48049af707150c1e9bfd4102f08cc0b802
SSDEEP 768:bFiE6esE8lDldUGz3UCg6lMd0u5zuXp6pQCUFTZovGqsW7iIKu8fqGotE184r:SeB85d73nl27BBUtZWGeiAhGiE1L
TLSH
T1E9038D3AD898D9A36CE68F89E71A365BAFE011A7C58C0BC4D9C95D0E10C705D338BD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5220-69-0x000001E4151E0000-0x000001E4151E9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads