fa173bbfc674f749b4c6275d1e270993407180b619e8c85da1b25dc4280819cb

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
spot-stream/web/img/apl.svg
Size 913B
Sample260528-pfdl8aex9j
SHA256 fa173bbfc674f749b4c6275d1e270993407180b619e8c85da1b25dc4280819cb
MD5 e356139ea90852da2e60f1ff738f3cbb
SHA1 6b6335b37cd02812c18c2931376c5e27ac357438
SHA512 d4b18271cef98513c8151526973c2d0bd56cc9671036b20162fd8acbe720e6fb33417144adea6dd3426802dd411a64eb9ddfb7f703cf16d903fbae41fc6dcfc7
TLSH
T10E110CFB9B66A0D1DAC6C764EB72520F72B6787A1FD4CA05C5B86F08825048C868F870
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_982722460\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_982722460\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_836514642\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_836514642\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3744	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31256309"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3685455815"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244444356784612"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{5B4AD33C-EA0D-4137-94CC-7E777DF52353}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4924	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 4924	5012	iexplore.exe	80
PID 4924 wrote to memory of 6012	4924	msedge.exe	81
PID 4924 wrote to memory of 3744	4924	msedge.exe	82
PID 4924 wrote to memory of 2104	4924	msedge.exe	83
PID 4924 wrote to memory of 2104	4924	msedge.exe	83
PID 4924 wrote to memory of 2104	4924	msedge.exe	83
PID 4924 wrote to memory of 3868	4924	msedge.exe	85
PID 4924 wrote to memory of 3868	4924	msedge.exe	85
PID 4924 wrote to memory of 5940	4924	msedge.exe	86
PID 4924 wrote to memory of 5792	4924	msedge.exe	87
PID 4924 wrote to memory of 5940	4924	msedge.exe	86
PID 4924 wrote to memory of 5940	4924	msedge.exe	86
PID 4924 wrote to memory of 5792	4924	msedge.exe	87
PID 4924 wrote to memory of 5792	4924	msedge.exe	87
PID 4924 wrote to memory of 5936	4924	msedge.exe	89
PID 4924 wrote to memory of 2528	4924	msedge.exe	90
PID 4924 wrote to memory of 5936	4924	msedge.exe	89
PID 4924 wrote to memory of 2528	4924	msedge.exe	90
PID 4924 wrote to memory of 1912	4924	msedge.exe	92
PID 4924 wrote to memory of 5928	4924	msedge.exe	93
PID 1912 wrote to memory of 5968	1912	msedge.exe	94
PID 4924 wrote to memory of 476	4924	msedge.exe	97
PID 4924 wrote to memory of 4072	4924	msedge.exe	98
PID 4924 wrote to memory of 4160	4924	msedge.exe	99
PID 4924 wrote to memory of 5896	4924	msedge.exe	100
PID 4924 wrote to memory of 5896	4924	msedge.exe	100
PID 4924 wrote to memory of 4880	4924	msedge.exe	103
PID 4924 wrote to memory of 4880	4924	msedge.exe	103
PID 4924 wrote to memory of 3176	4924	msedge.exe	104
PID 4924 wrote to memory of 5172	4924	msedge.exe	105
PID 4924 wrote to memory of 5172	4924	msedge.exe	105

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\spot-stream\web\img\apl.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/spot-stream/web/img/apl.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ffb44e2c188,0x7ffb44e2c194,0x7ffb44e2c1a0
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,16382418560594352341,9852705043259734085,524288 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,17465402978530362974,14137901792967159762,262144 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,9503082841716017644,12630683041089440537,524288 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:13
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,12703497250698419330,16260254390816727012,2097152 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,18432912083436749324,2306359814562723023,2097152 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,6589882507273878301,16190387594897810511,524288 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,758515238075968233,1766583058523859992,524288 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
    3⤵
    PID:2528
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,7382502190886180009,14628572135332143331,524288 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,2535452734900608695,3771490170276690613,524288 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,7382502190886180009,14628572135332143331,524288 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,1735495047355934638,12951190718625145467,524288 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,13863703314913056586,4136736563898170256,524288 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,972654140016983327,2816595608457282447,524288 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,1026668556435012273,16168227224849956214,524288 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,476463444319796825,15468477928645143749,524288 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6412,i,13893275660814511923,14807998333416677279,262144 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,9572429778026658990,17511721621358633637,524288 --field-trial-handle=2168,i,253748097796921428,6257515551325700869,262144 --variations-seed-version --mojo-platform-channel-handle=1180 /prefetch:14
    3⤵
    PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f99787c0ea6a2100c47e17df5f87151f48fdcc67d438d178370b390aafe035df
MD5 db3de179b0fb1900e793e66087e1c7a1
SHA1 c9478e46511eaef301c5550850fe1fe47dc75337
SHA512 5caa3f0e77f9242ed27016abc90f28980b69034ba616a39e54ba3aa18a699e38c42c5aad38f4b535a5b9b283f9d1aace226002a3015bd06f0fc297608bc8f8de
TLSH
T147F0A9AAC931AC2714FD0B1970A5574AEB55135B2780845F3B3D960C4FB567B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e8c1e1a77338c663ea07d5bf362d0e72673a6d456949e76a5769360a7e1431f1
MD5 44305d05d26b4bd2724e3c2b9581bc3a
SHA1 64a12b4f4ae8a32073f111745cae5e65254ece4c
SHA512 b59fe38004a7579ff788a115a49f2fe834b83aeaeaf1a29f8e353f7e168584ded588194e34b7da08005f516aef01e9cd2b849618175c8da01b4ebce570a4c0f0
TLSH
T1EE418DF3C3E8866E891195F0BB286E2FCE2D0954432C3D5A85E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 80ceb7b7614bcb4a951531cfcae484537b3c25430722b78162a5923dd4ddbbe6
MD5 d6d20f310c3adca21c91edfe7c956b5e
SHA1 37c6abb4db92200cc1e197fa2cc69946642c5bbd
SHA512 757ed102e80ffee94fd712c8967e490118fe226ed25af79010bc3d69d4b7e45f0f35a8afea2b49e88c985f506ea9c4c4d5f32e0340b204f97ba14cb754d097df
SSDEEP 192:sxZ3yR1yMqZjK1Ml8UQFco/fCsFSfE0CXUyynDXzodpEK/W6+WNGY0dMJGrIg5Vz:sxZ3yCqqo/fCsFS80Ly88r/bG5GUC+b
TLSH
T148720816AA38597B8CDBD219FA457B53D7F9152396540E44A9FC8F0C04E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 257701bc2348ee34c9e45cef50c128483d329ade6834cd1ed373738ff00d535c
MD5 0d0354517a6bc8fca7fb7f901ebabd54
SHA1 d198d1b8003a3d237c83556509773f71352f13cc
SHA512 7ad89834a809a178c36b68bd7574ea679b6af6b49520059d450fc6c7a3d774c305800ceb825e73d1df11fe974df6fde415c66147a317057ef706b3a59bbfa54c
SSDEEP 192:sxZ3yR1yMqZjK1Ml8Mco/fCs8wSMxE0CXUyynDXzodpEK/W6+WNGY0dgJGrIgj0J:sxZ3yC0o/fCs8wSM60Ly88r/bG5+Uj4
TLSH
T14E62F806AA3859778CDBD309FA457F53D7FA152392544E44AAFC8B0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 e3810716f0ab4d823aca74589bca6e92205d54739bf5ad86859491035fb8f2d8
MD5 73fd6088be0a11a4e8f1b73d49605b46
SHA1 65b00464bd2a35a72efb7ea7d059870028241c50
SHA512 e5e1777913a91ac8fd5b82d981946bdfd2eb86a798b9cf01394a313ff14387190290d55cf47d583cdab1b33a614b14f706b03436f1438690de875b56c238656e
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV323pQLlj:ciWKy8Eq2ADEn5dWRm5rQW7u1jaK23pA
TLSH
T103031B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 25e329c522168493455a52e9a1beff582703ad5aea85e8d6303849044281a13b
MD5 2b9559fea49318e5370f887dbafcdded
SHA1 d1826c730cfda62620451b1e847a2010ffda163b
SHA512 231d2fa23926a75658d780865d5cedc8b90a647a43e82189143004f331831cf61f194aefff96a74bc890fde90f6ecd0e777e5e39acf902ee5f33724256c1b72e
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7KPs:AFBHhTofhno2mB21q3Llbfe3sLDdeEpb
TLSH
T1B2B27D56717B12023C3E291CA6929B370E4272A3345CA56F7BB900BA4E67E215DFCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 826fa86a6d0e40b9fa03f044a168f68b01c1b1f599e2480a9cf9caa15517fe40
MD5 b30c24ebb309f74fc35b64127d139c7f
SHA1 8ebe536884d47ac06509e0cbaaa65050e47798b8
SHA512 3d5071f1bfdfddb6daf611d7e0b47a23390eb1bef89518248bfd00e2a2088c0828e5a858c15433a8720d1eb8ccb55f924a0b61403e4dfd5796cb07c8a55ed9b1
SSDEEP 384:nViFbtNnNnb9t38Np8TUNTUlIRLy9ZTjGfb7odYxLbeN1I2OHbglt0wHy/7Igr7:cFbjZbr3uwgMmo69yu2O7gv0d7
TLSH
T153D26C32E825DEB7EDE74E99B74A36839FE401A38D8C5AD4D5C89E0D00DB29D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 550265803e03ce7288dbc4417ddc4bf2b5bde1ee4ed3d764e1900461e183b5fd
MD5 5e27c3450865b3cb033c0545d2050d04
SHA1 a0e1b0e86aa0f5c222f2bad0eb27f921779f7b27
SHA512 6d62d8c7817cdb16712605ae25c90ce6c6f9cf83f1b7ed2374431d49eb17dbab96dee7e4bae8a5122901e2456fc1d122a865fda76cddbef847366dc0e9fb1ffc
SSDEEP 384:n5wiF9CcmyWCs38Np8TUNTUlIxBydvPoCajGfb7odYxLbeNvPhkP+lFYS/npHy/K:1Fccps3KwgiZxo69yvPhkoFYS/H
TLSH
T173B25A36EC58CAB7EDE64F99AB4E7A07EEE01163858C89D4CAC81D5D00DB1DD170782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ef543c1d8e3d8d4766fa5eca257868dd5078a2763019ee40850ee6e7f188db49
MD5 658879449616ab49c4cb9ca8b42f64ec
SHA1 806a05402cf7384497f2518cbe34ebf431890be9
SHA512 ff0f21b4a38b4e3064337cc47fbbe8adbd7429708a9195e42763067315d76f15a0eb0292b5445bba0f0aa0649ecb002b38692256ee46c5b422ef36784809a580
SSDEEP 384:n5IiFbtNnNnb9w38Np8TUNTUlIRLy9ZTjGfb7odYxLbeN1+2OHbglt0wHy/7Igr7:JFbjZb+3uwgMmo69ys2O7gv0d7
TLSH
T1C6D26C32EC25DEB7EDE74E98A74A36839FE401A38D8C5AD4D5C89E0D00DB29D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 291582f1f7366dfe33ea0cca42fd002535f110467871fe51a6991440b7fb91b9
MD5 f960d76572a3bac98b6cc11b61876a68
SHA1 42c9bcb2e9d6134aaa2848b644f8f0f373d3c1b6
SHA512 ff398bec37a68a85234f2152f8b55291ff456526a9e9aa14d9cd1434a8466bed1a726f8d44a616388e025d3647f4e1930efc0a765d68a055776f43aa082015da
SSDEEP 384:n5IiF1tNnNnb9K38Np8TUNTUlIR0yiZTjGfb7odYxLbeN1I2OHbglt0wHy/7Igr7:JF1jZbw3uwg6mo69yy2O7gv0d7
TLSH
T17CD26D32E825DEB7EDE75E89A74A3683DFE401A3898C5AD4D5C89E0D00DB29D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1f4ac013f0509c71fb55fc2dc30f3aadca663f12e748856ad9dc9944c6b989bb
MD5 86c806ff84e22abea3b1224d0ef6e578
SHA1 8bb9639c23f24e084ddcffa693ed8b54851b6d54
SHA512 e0e86bcfde0ba92f797939507d28f62cb8b1957b19e5c59fdb2efc88221b82e9b9cbf8fe8c1d2211de392b3031d4112a4aa64873a907b3794337178c9c8458dd
SSDEEP 384:nUiFbtNnNnb9w38Np8TUNTUlIRLy9ZTjGfb7odYxLbeN1+2OHbglt0wHy/7Igr7:vFbjZb+3uwgMmo69ys2O7gv0d7
TLSH
T18DD26C32EC25DEB7EDE75E98A74A36839FE401A38D8C5AD4D5C88E0D00DB29D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f5c13e1ff034c246406909f16e42d62cf598fc4b14a35f53df99911a40dc7b16
MD5 8975afd4f2355bcc1bc77b8ecc57dc74
SHA1 c73432ca4e7d2562c59aea077afd247a6fc49592
SHA512 07f41e1afc6088189acdd3538ed375c4795fa818a98d04dcb31ea9d95335b9e93b94f29af81e69f9f7e74465e85bf6ff96600aa0901dabda8752c35416575474
TLSH
T1074130E15C7C1AC1D4BE0E6EA48B38FC82EC8725F4A4357D6854EAD80A7961D648087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a5f7ffbb77789f5764765a8d26033c38c45df287480a7a952c37ba8c1e1bb594
MD5 1f360025a2a9a97adc278c5389e7721b
SHA1 40e4f7e4cf26587bb884794caa22b77fde4c7dec
SHA512 0f896419de50a0fffb886cd45b6487c4c1cc903608e517987c56f817637d5147a45fbd2cc1c0912c4c5d8ed592d0951e19f56541ad002ed91b03ba8ce31a4eee
TLSH
T1B94120E15C7C1AC1D4BE1A6E608B38FC81ECC726F4A435796854DAD94A7961D248087F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_836514642\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_982722460\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_982722460\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download