2356f4f2b651efbad7c8ee7f8e4dcaa51b9ce28d95394fb3a5254447f93818e1

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v15O-m1-eL.svg
Size 44KB
Sample260803-vgv6jstdpf
SHA256 2356f4f2b651efbad7c8ee7f8e4dcaa51b9ce28d95394fb3a5254447f93818e1
MD5 2afb4097fb2218401ce6072aa93f8307
SHA1 faf6a9c1effa6293ec2021eac520dce00486f4e0
SHA512 f66dca04fa73cbae407bab6bcc97525d8d397ef065a220094ce93dcf717293611e9f00d05915fc2d4c5bd63b27ce5714f07b8b27c62cc32ab4efccf5b81dd84b
SSDEEP 384:c827NHdmDcvlxO4fnH5AomEkJW9mOx790u+wycg9+fiUCFRlg0vlg90rf2:c/NHMWaA90C
TLSH
T1CF1340B537F43C9B8BCC034B6D42FC6C46BF94B78458668C9BD790E89548368B7AC5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_625935571\_locales\lv\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1932	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302499040452814"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{7FD32A16-002F-44E3-988C-2719ABB1BDCE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
7044	msedge.exe
7044	msedge.exe
7044	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
7044	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 6732 wrote to memory of 7044	6732	iexplore.exe	88
PID 7044 wrote to memory of 4500	7044	msedge.exe	89
PID 7044 wrote to memory of 1932	7044	msedge.exe	90
PID 7044 wrote to memory of 2248	7044	msedge.exe	91
PID 7044 wrote to memory of 2248	7044	msedge.exe	91
PID 7044 wrote to memory of 2248	7044	msedge.exe	91
PID 7044 wrote to memory of 3756	7044	msedge.exe	92
PID 7044 wrote to memory of 3756	7044	msedge.exe	92
PID 7044 wrote to memory of 6904	7044	msedge.exe	94
PID 7044 wrote to memory of 6904	7044	msedge.exe	94
PID 7044 wrote to memory of 6904	7044	msedge.exe	94
PID 7044 wrote to memory of 6900	7044	msedge.exe	95
PID 7044 wrote to memory of 6900	7044	msedge.exe	95
PID 7044 wrote to memory of 6900	7044	msedge.exe	95
PID 7044 wrote to memory of 6820	7044	msedge.exe	96
PID 7044 wrote to memory of 2648	7044	msedge.exe	97
PID 7044 wrote to memory of 6820	7044	msedge.exe	96
PID 7044 wrote to memory of 2648	7044	msedge.exe	97
PID 7044 wrote to memory of 2380	7044	msedge.exe	99
PID 7044 wrote to memory of 3192	7044	msedge.exe	104
PID 7044 wrote to memory of 1224	7044	msedge.exe	105
PID 7044 wrote to memory of 3092	7044	msedge.exe	106
PID 7044 wrote to memory of 836	7044	msedge.exe	107
PID 7044 wrote to memory of 836	7044	msedge.exe	107
PID 7044 wrote to memory of 6856	7044	msedge.exe	108
PID 7044 wrote to memory of 6856	7044	msedge.exe	108
PID 7044 wrote to memory of 6340	7044	msedge.exe	109
PID 7044 wrote to memory of 6340	7044	msedge.exe	109
PID 7044 wrote to memory of 3448	7044	msedge.exe	112

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v15O-m1-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:6732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v15O-m1-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:7044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb88b1c188,0x7ffb88b1c194,0x7ffb88b1c1a0
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,10349880223863082861,4851954833112510212,524288 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,11876782495311492550,3543516920075392537,262144 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,4022174948216239864,11083225137235388902,524288 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:13
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,3719710539740930872,3855568084971045412,2097152 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:6904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,10418770681910586600,227133731272052620,2097152 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:6900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,9322497480432882295,6695908677733898837,524288 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
    3⤵
    PID:6820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,4990607403563071075,4007019615494832557,524288 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,12443544145811049582,5765959705986844274,524288 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,12443544145811049582,5765959705986844274,524288 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,4496675445328507153,6931649970304086374,524288 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,15131857362350542735,4865568630993272643,524288 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,12533672880195061443,469374240003414166,524288 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,3388998580962530467,11046464578903622506,524288 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,4530397431225770282,17602355643776305210,524288 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:14
    3⤵
    PID:6856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,15383261196183727692,8883765779535852640,524288 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
    3⤵
    PID:6340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6660,i,17389694402615358898,12640490346000635053,262144 --field-trial-handle=2332,i,5779584770542097787,13135443787650755246,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 4e92a76c076a746a16004ba502927600a900d7a8f331ce6e4407a7e30d80d5f0
MD5 da3991c692677e5a19f302912a6a4c2f
SHA1 942b0fca911a0e0c2ab7cd25be13c1a428bb0465
SHA512 5d4f3275ac18a8945efa84cce496c99b0be6310d59aabd39e1a7ecacf0f7c5d83f81d912baadcf86ca2d374e3bf2a501f2a3e627f15a40687f96714dff19d5a7
TLSH
T1A8F02DB5C921BC3719FC1B2860980B47E754136B3B41989F3B3C921C4FB063B4686C1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bf726d2ce29b9ca595d8897439460b8653b2deafa9d060782ab9218c2cf7cbe3
MD5 8f25069e06e3fa02d7f4f7aab2036033
SHA1 84944dfa9db24c1130dfc3fd5951c0046478041a
SHA512 7ee688db812d10aad7b00f05638d6e3ca0197e84ce08909006c8adbc548cc43eac745dd54773414a614b42b034c7c11cfb633f324fa6057435db9d0959176cb8
TLSH
T1A251CEF783E8856EC90196F0EB187E2BCE1D0914432C3D5AC9E4AE1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b2e12342ef2a2799ecf2469f7d564a96f92989e5fb6c1270c7e52863ae7bde3c
MD5 37f411cd8e0cf8b8d25b6789583b60d5
SHA1 29b34c798ba2944f6a54bbf6415c2f9ab1186394
SHA512 507d269d63d816ab7a95db103d10bb180e988f9c442661db01f7f27004bdd5eccc59e54fe00d14f14e8abfcb7e10a8c6e9abe23c4c626fd5dcd004b70e0301a9
SSDEEP 384:sxR5uqg//fXksgIN/RIL19/5IW4ysGQkho:s9Rg//fX4SWr/5IW4ysGQ9
TLSH
T1F972F815AA749D3B8DCBD619FA857F93D2F81133A1905E44AAFCDE0C00E66ED610382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 992537535268118e69a631baf3f3d67a0475eaa0fbd5e2d0b61acfe4c05921cd
MD5 0ee1d1a41f829a2a6beb791284c923f4
SHA1 9dfb2d0e02e8f32f06bbba0de20f22f7fb85dbe5
SHA512 c8af9d75d2223dd15f169ca7c956f0b4bfcf1ecff15c61398697f101bf38c3be72e49429a89785c621abb8b77e14b16d830464f8930e6bbab88afa76a9d43cea
SSDEEP 384:sxR5u8//fXkswmN/RIL19/5IW4csGQkjQ:s9z//fX4EWr/5IW4csGQ5
TLSH
T1AD72F915AA749D3B8DCBD219FA957F93D2F81173A1905E44AAFCDA0C04E66ED2103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 72d99b90d9eae481e1e2da2749eb154370d7ea74e67d45f468d2b26f93206c3c
MD5 124e92aa1658506c1cb8f41edd19bffc
SHA1 64b5902d669411c45271027f6f262e6728ccb7d3
SHA512 c6787caf1ee18bdf0a089398f8adb1f920e8503d79ec657882d58c30d744cbbbfc7311f9350be0e792f773205bcc6d09bc3cfa366d679ede54cab7ce4cb99403
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDobbDwzroi4w:Ob4YZnE7yTWg1NfwBu1jasobHwANw
TLSH
T11CE2FC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8059dc257031ebadcfc53b0c1cec40e87f651ebe2bdea148f843bb0d8a584a05
MD5 8f5ab418b45cbd834dfecb4398be16ef
SHA1 c4d3f3a1716c4bb7675348798e4ea85dcc77a465
SHA512 f46dbdd4bd8f4ae4b51cce490d704b1d0d5706ad4ce59d2e18c1f6767a366337d3e0dff6800efa124ab05e010f7d2312249d4bfab27cd05db9b76b92da69f53d
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9h7N:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDR+
TLSH
T134B24B11713F5680383EB90C9179982ED6C2B4A37419E52F7BA801A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a659df70e51d56177ea2f740c99d936ef02370b70b83f6f4dc5b44c8fd2b83cd
MD5 880407b9a8408956725752b8cdfad123
SHA1 106acca0025c899859621e4828b49f1c75084403
SHA512 66457c7a946605f1466d7774181731de2b9ec8a07a3f606e1110a41f86f1a4eecb3059e4eb1972f20b8a0ae6928564d553886c571211fd87c7d045a3067fe12b
SSDEEP 384:nNiFiZcIL8NL28TUNTUlIR/PvuTKs9EqfbYG8oqGqrKhuR6HlytEDq19KDz8LEE9:EFQLQ2wgNuToG8DGU0Woy6DqDF
TLSH
T17DD25B31D8A4CD77ADEB9F99B64A3646DEE0117389DC8AD8E6D95D0C00871EE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 91a1416028ec2d3a032c933f367f4d817d71386837a813b97b8b22e13577fc3a
MD5 2e6895f740bce7e66e8c4bd0cbf21cab
SHA1 b717841e063aa5789d92d70aa449cf56149a9d23
SHA512 45f012fda3e27465d6d21586646a0240d9e5b35c973048d044e4eda6bf1e8c0a28973d7dca0ef8a9826441e22bc0f288968da72551cbb2e5ea9886ed543d42be
SSDEEP 384:nhiF1tNn/s3n9Sn8Ngc8TUNTUlIRiPvuTuxREqfbYG8oqHLukOObjI9G6w7aijhA:IF1j+9SXcwgUuoUG8Drn29MaWa
TLSH
T115C25A36DC55CEB7EDE64F98B70A7A56EEE0126384D85AC4DAD81E4C00C72ED4307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 09ed16be8d562a241b9ed85f4ccd7e08476dc882a258497bf8745c40accd805f
MD5 ebbf47ccf55b8e55c02611e22e05447d
SHA1 286c6350bb7d5312870c94194d07ce8cd27b9fa7
SHA512 306db22bcd9277fe1409698d4aa4f5425c1f69be42ff2c37e2a0786d25a273a1f9441adba0a97a55210ca8ef25d8143048c1404a2f1853c4d13713d5b2216b0a
SSDEEP 384:nHiFiZcIv8NL28TUNTUlIR/PvuTzs9EqfbYG8oqGqr2FuR6HlytEDq19KDz8LEE9:CFQvQ2wgNukoG8DGUwWoy6DqDF
TLSH
T17AD25C31D8A4CD77EDEB9E95B64A3646DEE0117385DC8AD8E6D95D0C00871EE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8d15a912c8a0897c1f754c2d7a0d52cc1617a0ac4211256ca64dabaee687d75d
MD5 9d515f93af1340326a64ca08f639b2ec
SHA1 7b4b4a2d2d05ca2cfcdbde00fc6af321311ead42
SHA512 c185f77e9d455d71bb6c029b57f90b1582d57d91ca6aa7dc65aa2eee37413082f2987d569f736676fca2b5e2a3c17263ff33d63f15d25ab6ade85898c8f8bc5f
SSDEEP 384:nRiFiZcIv8NL28TUNTUlIR/PvuTKs9EqfbYG8oqGqr2FuR6HlytEDq19KDz8LEE9:4FQvQ2wgNuToG8DGUwWoy6DqDF
TLSH
T113D25B31D8A4CD77ADEB9E99B64A3646DEE0117389DC8AD8E6D95D0C00871EE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download