0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
arvest/Astute/img/Microsoft/microsoft_bg.svg
Size 1KB
Sample260525-pg9faafv7q
SHA256 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
MD5 bc3d32a696895f78c19df6c717586a5d
SHA1 9191cb156a30a3ed79c44c0a16c95159e8ff689d
SHA512 8d4f38907f3423a86d90575772b292680f7970527d2090fc005f9b096cc81d3f279d59ad76eafca30c3d4bbaf2276bbaa753e2a46a149424cf6f1c319ded5a64
TLSH
T14E310059C51D3566EC04C3ACEAE1D468315E71EFA8A581C961849B3F95B0DCE0ECCB70
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_1042020232\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_156355070\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_156355070\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_1042020232\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1636	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3741094055"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31255638"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241851968934279"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{E7C2D430-4E27-437E-995C-DF779B2859EB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4924	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5248 wrote to memory of 4924	5248	iexplore.exe	80
PID 4924 wrote to memory of 5144	4924	msedge.exe	81
PID 4924 wrote to memory of 1220	4924	msedge.exe	82
PID 4924 wrote to memory of 1636	4924	msedge.exe	83
PID 4924 wrote to memory of 1220	4924	msedge.exe	82
PID 4924 wrote to memory of 1220	4924	msedge.exe	82
PID 4924 wrote to memory of 324	4924	msedge.exe	85
PID 4924 wrote to memory of 324	4924	msedge.exe	85
PID 4924 wrote to memory of 4500	4924	msedge.exe	87
PID 4924 wrote to memory of 4500	4924	msedge.exe	87
PID 4924 wrote to memory of 4500	4924	msedge.exe	87
PID 4924 wrote to memory of 1120	4924	msedge.exe	86
PID 4924 wrote to memory of 1120	4924	msedge.exe	86
PID 4924 wrote to memory of 1120	4924	msedge.exe	86
PID 4924 wrote to memory of 2324	4924	msedge.exe	89
PID 4924 wrote to memory of 5136	4924	msedge.exe	90
PID 4924 wrote to memory of 2324	4924	msedge.exe	89
PID 4924 wrote to memory of 5136	4924	msedge.exe	90
PID 4924 wrote to memory of 5908	4924	msedge.exe	91
PID 4924 wrote to memory of 2260	4924	msedge.exe	93
PID 5908 wrote to memory of 1520	5908	msedge.exe	94
PID 4924 wrote to memory of 2164	4924	msedge.exe	97
PID 4924 wrote to memory of 2608	4924	msedge.exe	98
PID 4924 wrote to memory of 3440	4924	msedge.exe	99
PID 4924 wrote to memory of 4100	4924	msedge.exe	100
PID 4924 wrote to memory of 4100	4924	msedge.exe	100
PID 4924 wrote to memory of 5268	4924	msedge.exe	103
PID 4924 wrote to memory of 5268	4924	msedge.exe	103
PID 4924 wrote to memory of 2200	4924	msedge.exe	104
PID 4924 wrote to memory of 3844	4924	msedge.exe	105
PID 4924 wrote to memory of 3844	4924	msedge.exe	105

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\arvest\Astute\img\Microsoft\microsoft_bg.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/arvest/Astute/img/Microsoft/microsoft_bg.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ff96738c188,0x7ff96738c194,0x7ff96738c1a0
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,17025029656808473280,15926991177407840158,262144 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,14795800674588204093,2654098635251066094,524288 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,11367644519171116028,11597244985472711914,524288 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:13
    3⤵
    PID:324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,17570226816288146985,229290058326365609,2097152 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,1568208203050005887,17415565964319304877,2097152 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,4620654835059478014,16595193343057134972,524288 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,8825371479710633790,7974699072704080321,524288 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,8130145815320146985,15592123435526995082,524288 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,4228458122485999745,15461999443510831122,524288 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,4228458122485999745,15461999443510831122,524288 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,3826096460772573732,15637679149671825333,524288 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,14851453336475099256,3327863886481534202,524288 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,6041466582747043532,5340353107529266651,524288 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,16993927961501824158,13214117566203190478,524288 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,16123195924432612662,17009961684162374243,524288 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5920,i,2896484477730898731,555960364733676101,262144 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,127788862800501873,3713345527657653443,524288 --field-trial-handle=2176,i,760207456428769442,8643943453484711535,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:14
    3⤵
    PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

994cff2f-8cc1-42ed-96b2-238b42c4fb8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\994cff2f-8cc1-42ed-96b2-238b42c4fb8d.tmp
Size 28KB
SHA256 cd79715912fd7bbe6ef93be9cc7f27b577f9d531b3196152e249c4082cff5cf7
MD5 40d7fdfd93a2d5bf5202760cadd4678e
SHA1 b6cbd85d059751aaed735ddab91f057ce0d8dff4
SHA512 00825259e38c66723e04bb0868fdc3309a31f64da3eda2f17a9768ee6ae9fb97e7adb1e3353a221b8f385625ce92a5ef1650424e9da90c3bc6f7ba51b680f108
SSDEEP 384:n/iFxtNnNnb9v38N28TUNTUlIRGyvznjGfbwo2qNiZRBiW13C+U8XhGXDqfNcbJI:KFxjZbF3NwgdroFmRcW1SrmGTiQS
TLSH
T133D24A32DC64CEA7EDE79E95A25E7B43AFE401A3898C5AD4D5C85E0D00DB29D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 6bef045e16e36329ca9e1862f168ed2bf19d805ddcc8a3e63c9f2f5af9be78d0
MD5 cb59c031387dd7168da887665e62649b
SHA1 6da97eecfc9f57b52e4af5b99605fe005d9ce18a
SHA512 ced0e7af4f8db975efd5a60a552187c9ac2c0b074f5646a4b65052d5e167e0197ae4d3bb6c48c7625be3aaf75ddcf7a8a6bdfcdc9fc195542bfc31735de8cd31
TLSH
T180F0F9BAC920AC2714FD0B2D70A9074AEB9413572780845B3B3D420C4FF163B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b93d03a05aac81387592beb25c1232aaf59fec181a199ce5359da648cec93e51
MD5 0014b2db6a18a3ae41cfd9c13d47b96b
SHA1 7128d2d9432c136abbe715f45a2e6b2469eca66e
SHA512 d7f958b75314e42b7342404a3e63200dc2701e67901de077efc5de313e952e832b86be83d4556215869b22f5237c66ccb4df7379d94718d45015eb5015794d7c
TLSH
T1DD419FF7C3E4856EC90156F0BA18BE2BCE2D0914432C3D5A85E4AF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4f1f32db75e9aea408ebbe809e3582993dc7d5b1cb25f53c3772539896b4ad42
MD5 de67c135248b774546f75d70e12cc1d2
SHA1 88e840741bf423fdd5d63bdc2d2fe32d7f62f0bb
SHA512 2ceb704ebd22e2d6547fd6236fe9a5e667b0de4e61a80d71215a70cf7db41976a9315e48f3cc31e9d722ddd37033fa5e623626f4eeec26be409d54d568c08ca4
SSDEEP 192:sxZ+RJyMqZjK1Ml8UQTc9/fCsJEg0E0CXUyynDTzodpEh/W6+WNGY0d9Wy2aIg5Y:sxZ+uq49/fCszb0Ly8IY/bG5Wr6PFc
TLSH
T18662F816AA38597BDCDBD219F6457F53D7F9152292500E44AAFCCB0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 02a6bf1759419022dd2478c7f9a206fae7dae3747ca59165a9dde857d364e3af
MD5 e376ea59741699d47b9de70b266999bb
SHA1 3ab582cd8eb26b8875a769087c98c60d70b069c7
SHA512 475fa1278d7a0eb8023c2bb536aefadc58d634962b1b74b041f5862a8491c367cde6340d4fab59ce4c6942308b87b95fecf3de791013002b5b3ab76a451a5fd3
SSDEEP 192:sxZ+RJyMqZjK1Ml8Mc9/fCs86EghxE0CXUyynDTzodpEh/W6+WNGY0dgWy2aIgjm:sxZ+u09/fCs8Eh60Ly8IY/bG5jr6jm
TLSH
T1B062F816AA3859778DDBD319FA457F53C7F9152292504E44AAFCCB0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 f851dc5a9c79c6bf5ee8b8b9b8b729854804601e2bf121a4be5668eb63fdeca7
MD5 f49dc86cee1d188f5a8a80d9fd61e3d5
SHA1 05685a1dd486a84142ebaaa70ce95b746424a74f
SHA512 72888660b113274dbcd5cc7023dc5704972d603ac7d19a23d8c424dc5e711a52eb61d0b84eca2a3114a83cf3dfd5905804213e63d985e84bedd822995460c12c
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV333pQLlH:ciWKy8Eq2ADEn5dWRm5rQW7u1jaK33pQ
TLSH
T1BA031B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA444C03C76EF551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9448d5993919c519358cfddd02eff332201f97c533e8a842f02647ddb20d91a4
MD5 c8460e1dbbccfb4271080568f50d4a6a
SHA1 f1247e1aa0f70e55c5d4d95484f7d9306cae40f5
SHA512 6292df6f3ec65da2b1cd13e0d50a0bf447d529ca460653d04ccfe000c4b33920906906c09c503f870f92b09f4f7219e171efd00870437570af0705317661811e
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7Gna:AFBHhTofhno2mB21q3Llbfe3sLDdeEpV
TLSH
T1B1B27F56717B12023C3E290CA7A19B370F4272A33458A56F7BB900BA4E67E615DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 94e230335eef0351943840a20f436c662087c9778b6d39da2dd4d2a68687927c
MD5 5cca4c381714b4006262fbfc7a229ea0
SHA1 c15330b752b93845d1540f95ae18baf75f041a11
SHA512 0c5b22d5fc5c8955d3a5e211936feb67c38a7594b00be68a92e7294c749ee7a425b27d740d29d2b75e4565374a223de3195dd74632a8b36645bccdfb97db5bde
SSDEEP 384:nhiFxtNnNnb9738N28TUNTUlIRGyvrnjGfbwo2qNiZRBiW13C+U8XSGXDqfNcbJI:IFxjZbF3NwgJroFmRcW1SrHGTiQS
TLSH
T111E2A3F198D78973E9DE4B97A37E6E02AABCC153B4480A94F7C85D0DCC8617FD206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 648cdf208a8ffeceb0f4e697a34849f418fabca67ed37735da9c0870d55a0bb2
MD5 ef6ea43be1650f643943bd10f573b7e3
SHA1 6f003c00286ef2edecaac5a731adebea8e0aa1db
SHA512 4122f97d0bb414424ce25a68830fe728a87c74221450c0c4942c3d724b0c98b157c0ba5861f208cd6e3f398a72862f34694409d9b9a0732ee9f9f9ec3a5ba9da
SSDEEP 384:n5YiF9CcmyWCs38N08TUNTUlIxBydv8o5ajGfbwo2qNiZRBiW1sWhkP+lFYS/Z1u:VFccps37wgh8ioFmRcW1sWhkoFYS/1M
TLSH
T1C6B24B32EC98CAB7EDE64FDAEB4E7A03EEE00163859889D4DAD81D1D00DB19D1707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 016232f66ab90e329ff736cc9c65092c887389e6b34f6239bbf5a211bcf13616
MD5 b8bb295ab628622de32d68b8d3267b28
SHA1 6aeb2330908816e8854cc4ac956840f2c6f3280a
SHA512 53554382ebb8297b909a9767c4bf5a5fad71994e62e1d7b45630b9231df8e0e9514e9f2e2fbf8b2381c63aa643ed42768da79e193e0dcf7f820a37c3b9544436
SSDEEP 384:n5riFxtNnNnb9v38N28TUNTUlIRyyvznjGfbwo2qNiZRBiW13C+U8XhGXDqfNcbC:MFxjZbF3NwghroFmRcW1SrmGTiQS
TLSH
T122D24A32DC64CEA7EDE79ED5A65E7B43AFE401A3898C4AD4D5C86E0D00DB29D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 db4d90a0b1e85f890a8dd86f7c69c72190bf0ab4d65fb576d3a8873c8d8b8195
MD5 568361d413e21a3ae848d64623b51f6d
SHA1 869e7c6dada1bdb4153458db96ecd51bae1d2fba
SHA512 dd81f30fcaf604d6e818b2d66e15264c40d25b37dd63a195dbcb7dcc6d3d5a5a871526c7e8ea26db67da52da390c15b6465e7d4405cc00f2df518293954f8200
SSDEEP 384:n5riF1tNnNnb9038N28TUNTUlIRuylznjGfbwo2qNiZRBiW13C+U8XkGXDqfNcbC:MF1jZb63NwgvroFmRcW1SrlGTiQS
TLSH
T192D24A32D864CEA7EDEB9ED5A64E7B43AFE401A3898C5AD4D5CC6E0D00D729D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
Size 426KB
SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
MD5 03151e6660e6bbfa692924e34f19864f
SHA1 6b6ab73d35013c474e03e864634d05f264c5de22
SHA512 a30e4932722ab12bb106b4727610272a987a9222b15b727bfe062c370fa4234b2c5c82e6858b3454ebe17cdaca02444ff5d9b00df76f41b1fd5a585c4bb981de
SSDEEP 3072:aOtMYwJuo6nLA5ORUEaT7EfDhixsu417P0++di92iLUJs:PMNJuoL8avC3N+09nUJs
TLSH
T1AE94A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4a4990d9c56f9f0b39ce5966f9c508a404d27298ae1b43a9328add06e261693b
MD5 4db3a011e324e090f527d70089ae7f92
SHA1 34b53743b204c47328e0a50830d5212b03a4b86a
SHA512 1a12c40168c7281f3873a26af5d9460eff654a9da30997cfd20ecf73789dd7750603ee25cce3bb77f57f5a09f6f5832cbc0bafcda8fc7f7ceccea76cda47453d
TLSH
T1B04130E05C782AC1D1BE0E6E648B38FC82EC8725F4A4357D6818EA98097921D648487F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_1042020232\manifest.json
Size 118B
SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
MD5 af04c6b51c629f6364ecf578ae4b7127
SHA1 f9226903a59eb69191bc0c37db0c0f0a09c40c4a
SHA512 3aeab2a0269ebc7368d275ea57a7105bf90cbb2a68e7824c3a6d724eef426067c7478cef558d511116a900d13d406d3d92ac32c9fd859e83b95f8b17def8e031
TLSH
T16EB092B10C0AA47B26809720ECA0668283F80218E8065B1A088076881FD817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_156355070\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_156355070\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download