hxxps://cdn[.]discordapp[.]com/attachments/957269981274464266/1448994398355587203/Steve_Skin_Pack[.]zip?ex=6a8c25b1&is=6a8ad431&hm=a564ab4e1c75a383727056c93a5a827fd511b2019198ae55ba624a69fa99d274&

Analysis

user interaction
yes
max time kernel
60s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/957269981274464266/1448994398355587203/Steve_Skin_Pack.zip?ex=6a8c25b1&is=6a8ad431&hm=a564ab4e1c75a383727056c93a5a827fd511b2019198ae55ba624a69fa99d274&
Sample260823-wk2ceayfkf

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4944	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319815925668814"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{AFED3F9E-0C6E-41D5-A848-E44E5A2FC72A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2588	mspaint.exe
2588	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4152	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
2588	mspaint.exe
4152	OpenWith.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4920	4932	msedge.exe	87
PID 4932 wrote to memory of 4944	4932	msedge.exe	88
PID 4932 wrote to memory of 2392	4932	msedge.exe	91
PID 4932 wrote to memory of 2392	4932	msedge.exe	91
PID 4932 wrote to memory of 4236	4932	msedge.exe	89
PID 4932 wrote to memory of 4236	4932	msedge.exe	89
PID 4932 wrote to memory of 4236	4932	msedge.exe	89
PID 4932 wrote to memory of 2220	4932	msedge.exe	92
PID 4932 wrote to memory of 1644	4932	msedge.exe	93
PID 4932 wrote to memory of 2220	4932	msedge.exe	92
PID 4932 wrote to memory of 2220	4932	msedge.exe	92
PID 4932 wrote to memory of 1644	4932	msedge.exe	93
PID 4932 wrote to memory of 1644	4932	msedge.exe	93
PID 4932 wrote to memory of 548	4932	msedge.exe	94
PID 4932 wrote to memory of 548	4932	msedge.exe	94
PID 4932 wrote to memory of 548	4932	msedge.exe	94
PID 4932 wrote to memory of 2656	4932	msedge.exe	95
PID 4932 wrote to memory of 2656	4932	msedge.exe	95
PID 4932 wrote to memory of 2656	4932	msedge.exe	95
PID 4932 wrote to memory of 4728	4932	msedge.exe	98
PID 4932 wrote to memory of 3904	4932	msedge.exe	99
PID 4932 wrote to memory of 4728	4932	msedge.exe	98
PID 4932 wrote to memory of 3904	4932	msedge.exe	99
PID 4932 wrote to memory of 4028	4932	msedge.exe	100
PID 4932 wrote to memory of 4028	4932	msedge.exe	100
PID 4932 wrote to memory of 4028	4932	msedge.exe	100
PID 4932 wrote to memory of 4784	4932	msedge.exe	101
PID 4932 wrote to memory of 4784	4932	msedge.exe	101
PID 4932 wrote to memory of 3624	4932	msedge.exe	102
PID 4932 wrote to memory of 4756	4932	msedge.exe	106
PID 4932 wrote to memory of 808	4932	msedge.exe	114
PID 4932 wrote to memory of 3080	4932	msedge.exe	115
PID 4932 wrote to memory of 2648	4932	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/957269981274464266/1448994398355587203/Steve_Skin_Pack.zip?ex=6a8c25b1&is=6a8ad431&hm=a564ab4e1c75a383727056c93a5a827fd511b2019198ae55ba624a69fa99d274&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffaf729c188,0x7ffaf729c194,0x7ffaf729c1a0
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,5851544212120263891,10474926604981823678,524288 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16944948856698599439,10649150654963982581,262144 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,5140733102277260406,8845641225678888973,524288 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,7723311579726890185,1609578977183518838,2097152 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,10450864743542034585,15874973392233495771,2097152 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,12292693819843039813,1475630988369451045,2097152 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,6016308562972219873,4982860495374640042,2097152 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,4772704077522950639,14720539407676738633,524288 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,12865475914842120565,15930689452549355324,524288 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5652,i,9062811129234718723,1096059517920797974,2097152 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,7105081405092189726,17889398618262141109,524288 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,3153530616671941168,8060022866859973366,524288 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,14592579925827938882,17263330706600523220,524288 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,14592579925827938882,17263330706600523220,524288 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,2266488447832976784,10326028623327183446,524288 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,16752035915146477130,13516168073071302506,524288 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,1593943811688472425,14214255562546921090,524288 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,13101523729555196761,17785307307096172429,524288 --field-trial-handle=2212,i,18366780967875735946,13307178500218673585,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4136

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4252

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Steve Skin Pack.zip\Steve Skin Pack\persona\skin5.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4616

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4a302129b10cf3ac8d6fd58a3a115f3f386534b351087f5a1cace69357f97312
MD5 77728a4729b6fd40e598dd660abe576a
SHA1 68496608431a924a2d7c2121e8150e4f311e8140
SHA512 f142cd9419f9f0c16da905686ab4285a9458d6c66c5b6488e9a2585b7c19e4585467885a2c2b0f98da0edcf3314d34c539118044e770f5666f21a0196dfc6daa
TLSH
T1D6D02330A9DCFCE0E0360438813103027DCD8A893483A307B000441E4C753C373D94B3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 af62a2f982c17262aeab997f7ffb9aea7fb3637f9c94d35b3c786ff25f11dd70
MD5 70cb610f793a8524dd5273a221966762
SHA1 962de20068b23626df887443b4ecb55dad9cefb4
SHA512 4544ba4c9651515bb85e0d9a33a36ae05614718712bfbb81aa53f919200e23fbacfa3613a1aa9d8763171504d52fb3ed0a18bffdda8ec3d4cc22e2b7b2c6e9bc
TLSH
T14E711ADD3322D492D3600E30F7EF0693B9F141980A8F6D56F218597D6A0AB6F527B538
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c88b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c88b.TMP
Size 3KB
SHA256 fe11c2005e1a00735c2a49eba173bc96a6bc60a4d482f5ad0b7363601513cb2e
MD5 e70e4b9ceda2a4e0c7ab81879be46113
SHA1 379670af6f9948fb3504e857ba99088dd6e4588d
SHA512 ffa60760fb8b9ec1591f8c2e26b65bc9b5c3c8bb306f51abbdd88367b88393805b3fa636034a53d635edeaca53817dbecf8350ed49b28d1c2c26f62bef13abef
TLSH
T1A1711ADD3322D492D3600E30F7EF0693B9F241980A8F6D56F218597D6A0AB6F467B538
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4fab74e15b5557da894d5c42aacda0842caf6928fb548fc09a41f9f1eae3714b
MD5 7aaa86097bbb55b31e804e2b14ca5dc6
SHA1 4ea9e3c386bd8301bf3db5ee43490c027536d9d9
SHA512 2e923e5105be1981b2e65a02a3e59d873787d17fdc064d71e6b9202174767df3aece58ea8f114a605a34765ad2f84f2b26a9d2521d23b72660df57baa3c638f7
SSDEEP 192:sxZnR8yM/jK1Ml8MrA9/f4sKOmIdpJHW6+WNGYw8LA7IgrJ:sxZnujA9/f4sKOHJHbGB9
TLSH
T17142E601AB34A97BCCCBD209FA557B53D6F94472A2900D44ADFCDA0C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6f94e4f0df5c6eebe6ba1141632e87bd78f974c0cd57bd428e39a9eeb7a2b30d
MD5 d39269b4ee105fa3ac03338e5750ba7f
SHA1 0c100b183d24fae42ee55073c6cacfdf09cb24ba
SHA512 0b7d370660928ef908f1766c3bd62dc88eb8c74e308751eb74af23ba5e660366fcb8a3f45f4e33a7a0d32489ade210a8cca7e57a56e1aae73794c0143863e0b2
SSDEEP 192:sxZnR8yM/jK1Ml8Mbj9/f4skOmIdpJHW6+WNGYw8OA7Ig5QJ:sxZnuTj9/f4skOHJHbG8W
TLSH
T1BC42F801AB34697BCCCBD209FA557B53D6F8447292900E84ADFCDA0C05E6AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e35bf5220a70efd71328fc011d28c173c05e3d875e051ec77a9036614a7ac541
MD5 f0d003195d5b59c32496c348f7891f1e
SHA1 62ed167bb0ce1ac24185babf893c81a39d4403f3
SHA512 b435e2ea2f2934788b06eed9bb7ff4d0542d4f317cdaf1b1fa341a83daeda8d2e66b18b21e1c9ee9e0cac9925509bcc2754f9b3d9b498132f57b5409a06ff0a2
SSDEEP 768:pm4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dCroh0Wc7ah:pm4jeXmWvmKLEu1jacPLZQdZQW
TLSH
T15FD20A3B284CCF7E4F844E5CEC26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 81e95dd2919f46759cd8befb813a58ba46ee36e1be4fa74510ce77e14ae39181
MD5 8d9735c02e864aa03fb0e29527a68802
SHA1 04197be564aede8d11d06aa13153ce87e955984c
SHA512 c82178f3f617f03fc19eefe3a621e68c6e715ca64c8d9b7091cc58517caf490bd25daee86b37b2a78aadf988032aa8d3e7b6d931ae217907d61dcf1044b71f38
SSDEEP 48:K0CFI9K+IgXyp6IfKP6ADZst5Hn3ylf6BIkJyKD3rjy/Jiu2:K0CF6K+Iq66UKP6gGYKzye
TLSH
T187914D0270BB62413C7E680CA691971A1B4271673518B97B7FA800B31E77F684DFE8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f306046cb6314e838af35d32d6ce2deca63960e622f287ae364a4df63e732872
MD5 d4789193515a31043ed5562b0f4e8005
SHA1 640a3650a1b949a9c2c75567a89c0637ec7ac7d5
SHA512 8316c669493fe290798e9bad162bf6b3cf6732ae0e64aa4ce9a547dad3ef4cf895160247282d09c917ff7e0b017548454a369ccb967b41f4ac9b02b7cfe76a3d
SSDEEP 192:uUk9sNbkQccZEDiQmiU17Fv4H/+jV0jzorWYWXp5cFTYq5jqC+HN:OsNbk5dqLAf+G8WYWX8Fn3+HN
TLSH
T136422C32A878AC375DE3A541F44732138FF491679AC96F84DAEC6B1C00DA65C130EC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d4eec775bbe5a0bffbc9f171961f5a6b85c0cb9b1f850bfa6a5dd92918fa6291
MD5 7ec4af099bd1b7a7a2fe702e8a394f33
SHA1 28eeca8d9da3d4a751db62b3cb84c1edf085f1b2
SHA512 4356ce7d515814e3944c3f968710876248760a69745604ca15466195ba17bdc9062e92ecbf1e964eddced76dd4ef5fc4395b5ec3501d66c936d186df58b2bba1
SSDEEP 192:uUkPsNbY/QccZEDiQmiU17Fv4H/+jV0jzorWYWXp5cFTYq5jqC+HN:GsNb45dqLAf+G8WYWX8Fn3+HN
TLSH
T1AA522C36A878AC775DE3A541F44A32138FF491679BC96F84DAEC6B1D00DA69C130EC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f486874ff61a6a31bd39e2df85982c0101438babf69a280b6ef917a50115e738
MD5 3738ee6cc71dcabccc6bf9c3316a52e2
SHA1 d965d696f6d18de2146f29afe0a042e8a830ffe8
SHA512 ed576008c42ff13ad758b90e756f6700ab0880fe11fcc33d93e221168d68dc0f8c37899d88e1d62d09d3bd88e50fe11662b48fd29c1419ccf0dfb5fbfee1603e
SSDEEP 192:EONC6hZ0QmiUyj3pc/+jV0jzorWYt5wOZXiU6:EONC6oUpu+G8WYc2SU6
TLSH
T1A402D935A8686C7B8EE2AE45F48737235FE5112BAD956F84EAEC1B1C00D775C2346832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5b7e05561a4e9c421b9823e37a61c691b5423d4c0b6239ec50ab2ab3559a8502
MD5 3e68044d69c8dfc2264873a10ed8e651
SHA1 5482b8f16417ba8a8920ea4be9b68bf6ce81a93f
SHA512 1ce81055c3b6987e1a3f78d0fadc4ebd9ec8f481a26a78d780d44ac25e68311403bc1384b75360523f87c53fdacaf32f7b3582c2de9bc0149e15772b7e2b325e
SSDEEP 192:u4kb+xasuheOwQxMRsNbY7QccZEDiQmiU17Fv4H/+jV0jzorWYWXp5cFTYq5t4/S:mZcI2sNbq5dqLAf+G8WYWX8Fniv1uDoi
TLSH
T154927E719C78AC7759E3E245F44636134FF890279BD9AF8099ECAB2D00DD6A9130BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 28bf057319691d4b6191bd2c116c486cdb1b6f8fac117e4cdc08bc132ecebcee
MD5 9a5b3ba31dfb028b57b4d51e4e5122c4
SHA1 1b4c93edc37d04e0c515bbedc78842b6e11fc7d0
SHA512 c9d6ee539fae4e66c6b06ee664500e37c3f1e7c4bfc9affed23b37cf1d5c5684a4768bbf413dfe141ce0bda88c6321b3334d1852d6fb2a828f2ea8648f77d4f0
SSDEEP 192:QON26hZZQmiUyM3gc/+jV0jzorWYWXI5cOqYq5U6:QON26jpgu+G8WYWXT9nU6
TLSH
T13612D936A868AC6B5DD2B545F48732235FE55127EE85BF84EAEC2B1C00DF65C134EC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da882e96-d61a-4a86-9230-a291ede0d08e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\da882e96-d61a-4a86-9230-a291ede0d08e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Steve Skin Pack.zip.crdownload

Path C:\Users\Admin\Downloads\Steve Skin Pack.zip.crdownload
Size 613KB
SHA256 b76a3c68da94c830eb07545935f14cc0a8bf52242d0fdbc7576b9eb5013e5327
MD5 9bf6930230577d6168716cc1e498aaab
SHA1 e48bf5a92ede2c73f6b9f4b68f4604740e785d28
SHA512 49cae0933d95e7fade46970d2d97e02f99fd97f6224a0181d8dc118e08b70cb0d4b30f34bfbf33cd5d2010c1b24c8c5079ef143752c4456da124ad06d6f7ecdc
SSDEEP 12288:nAUZ+OmWHT7bNaLLokC+sGFtYHxzsG8M8ZtkkZ8AT2TP:p+CzP0sGS38rGAiP
TLSH
T138D4E1F3CBA36C01CD1B6379C11BC131ADFF711A86F0E4045E29DBA4682E689577E692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4616-192-0x0000025D733B0000-0x0000025D733C0000-memory.dmp

Download

memory/4616-211-0x0000025D7C060000-0x0000025D7C061000-memory.dmp

Download

memory/4616-210-0x0000025D7C060000-0x0000025D7C061000-memory.dmp

Download

memory/4616-209-0x0000025D7C050000-0x0000025D7C051000-memory.dmp

Download

memory/4616-208-0x0000025D7C050000-0x0000025D7C051000-memory.dmp

Download

memory/4616-207-0x0000025D7BFC0000-0x0000025D7BFC1000-memory.dmp

Download

memory/4616-205-0x0000025D7BFC0000-0x0000025D7BFC1000-memory.dmp

Download

memory/4616-203-0x0000025D7BF40000-0x0000025D7BF41000-memory.dmp

Download

memory/4616-196-0x0000025D73C60000-0x0000025D73C70000-memory.dmp

Download