d78815299fd2ba2b3fea05f7c5662295c55e9b87f5659718b5dfc273f4fe78dc

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v10J-m4-eM.svg
Size 24KB
Sample260803-ynph5aeh64
SHA256 d78815299fd2ba2b3fea05f7c5662295c55e9b87f5659718b5dfc273f4fe78dc
MD5 8c786d4da80ac1948a137a727a12fd7e
SHA1 0fb0844fb479811339f7104eb281a91b930ca91d
SHA512 838d9d0ec608d1e47dd3722b8ccd401e03eb334982cd433a7f896e66b62a9e69b9d2d3e8209914dd8563af8734ee368742a979b7e861efd480707c961c193a0e
SSDEEP 384:c5veJtU7WSADG+2tM8LSB7XXZwuw5wE1/7PRP3uDCr:c5vQjqZmDK
TLSH
T11FB21F6437F87C978BD803479D02FC68461FA877C4A8678D93D7D4E8A988368FB6C560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_1625286288\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_1625286288\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_1621487658\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_483295513\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_483295513\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6044	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302606380158175"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{EFC29915-3E2E-4713-BFCD-3BAC2335BB1E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5532	msedge.exe
5532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1116	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1116	1092	iexplore.exe	89
PID 1116 wrote to memory of 3884	1116	msedge.exe	90
PID 1116 wrote to memory of 4824	1116	msedge.exe	91
PID 1116 wrote to memory of 6044	1116	msedge.exe	92
PID 1116 wrote to memory of 4824	1116	msedge.exe	91
PID 1116 wrote to memory of 4824	1116	msedge.exe	91
PID 1116 wrote to memory of 364	1116	msedge.exe	93
PID 1116 wrote to memory of 364	1116	msedge.exe	93
PID 1116 wrote to memory of 4476	1116	msedge.exe	95
PID 1116 wrote to memory of 2692	1116	msedge.exe	96
PID 1116 wrote to memory of 4476	1116	msedge.exe	95
PID 1116 wrote to memory of 4476	1116	msedge.exe	95
PID 1116 wrote to memory of 2692	1116	msedge.exe	96
PID 1116 wrote to memory of 2692	1116	msedge.exe	96
PID 1116 wrote to memory of 5192	1116	msedge.exe	97
PID 1116 wrote to memory of 5192	1116	msedge.exe	97
PID 1116 wrote to memory of 5192	1116	msedge.exe	97
PID 1116 wrote to memory of 4620	1116	msedge.exe	98
PID 1116 wrote to memory of 4620	1116	msedge.exe	98
PID 1116 wrote to memory of 4620	1116	msedge.exe	98
PID 1116 wrote to memory of 2980	1116	msedge.exe	99
PID 1116 wrote to memory of 2980	1116	msedge.exe	99
PID 1116 wrote to memory of 5428	1116	msedge.exe	101
PID 1116 wrote to memory of 5428	1116	msedge.exe	101
PID 1116 wrote to memory of 3080	1116	msedge.exe	102
PID 1116 wrote to memory of 3080	1116	msedge.exe	102
PID 1116 wrote to memory of 5924	1116	msedge.exe	104
PID 1116 wrote to memory of 2472	1116	msedge.exe	105
PID 1116 wrote to memory of 2472	1116	msedge.exe	105
PID 1116 wrote to memory of 2656	1116	msedge.exe	106
PID 1116 wrote to memory of 2656	1116	msedge.exe	106
PID 1116 wrote to memory of 3512	1116	msedge.exe	110
PID 1116 wrote to memory of 3304	1116	msedge.exe	111
PID 1116 wrote to memory of 5780	1116	msedge.exe	112
PID 1116 wrote to memory of 4728	1116	msedge.exe	113
PID 1116 wrote to memory of 4728	1116	msedge.exe	113
PID 1116 wrote to memory of 2320	1116	msedge.exe	117
PID 1116 wrote to memory of 2320	1116	msedge.exe	117
PID 1116 wrote to memory of 2740	1116	msedge.exe	118
PID 1116 wrote to memory of 2740	1116	msedge.exe	118
PID 1116 wrote to memory of 5532	1116	msedge.exe	119
PID 1116 wrote to memory of 4256	1116	msedge.exe	120
PID 1116 wrote to memory of 4256	1116	msedge.exe	120

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v10J-m4-eM.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v10J-m4-eM.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffaa4a4c188,0x7ffaa4a4c194,0x7ffaa4a4c1a0
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,10347499896582076980,7602627293316188099,262144 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,2429989462464767439,14699723030687253459,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,17560883875179285670,4089760307259425987,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
    3⤵
    PID:364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,13270340340112227017,10088333735980599498,2097152 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,7830826784584920437,14305689908512660910,2097152 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,17623058338390753895,16882206238376377777,2097152 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,4174301042923811012,13449755694078510749,2097152 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,8145332614938134966,10493219895393836239,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,11919225367853628367,14143790096800242535,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,541608059475747241,12717375953302681403,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,4669481279538774450,5211878607797027359,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,4669481279538774450,5211878607797027359,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,7210033072754820129,6319489261584842918,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,17950188339294928118,5423565720139760577,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,12893972597316228355,13125385397938380819,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,17294672478790497671,2044735515146822367,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,8445920837078233947,2350589833038618926,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,4492528089954877294,3101655732090989968,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:14
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,11013799557737668046,15399038771684923430,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,6153859705991050786,17926640095948959396,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:2740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=932,i,13534065603197202939,5672806885956525430,262144 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,16944536010358075007,7498295411709317333,524288 --field-trial-handle=2244,i,15669219662793221312,7602524545708210377,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
    3⤵
    PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5c877b3347ecb306d991d0aacee1f05a018c749227bf275f864499b22a9b0fad
MD5 50489448d1b47fddd27cf846604a7e75
SHA1 60a55175c073cee00b9cb6c71c698891284d3ab4
SHA512 51cabf949f5ea61de2405bcbc462d59daa35f820441c9538c7358ed11ca0335e917a2d5b1d88cfb7df8a3e90f3889624ecb6c2793f422a42b2c5187c4fcc0cc6
TLSH
T171D023747F7557D0D11C00754420564062750772359F535561A1641CFDB488493FFDE5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ea1466425df91d97d2dff227356907bc2fe42badc254e1122d8193e2d6551266
MD5 e6ec0c69259e30d08e32795ddcaa93d9
SHA1 ccfc020eca291067f3513d15bb4c7bbf62ae8e1d
SHA512 7fde9ce02367636328229c07fb7c6fe074bf2a30516065b8eecfaa2f4683053f55f52b4eefc99ab66cc5e036c9533d5fa5f0c0777765d2bc831eceb819b53c0d
TLSH
T1FE512C3303290AC1FF75CEBB70E524AAB2F59484360B6E1618517EF45807F1792E056F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599f53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599f53.TMP
Size 2KB
SHA256 aa20114a27de06cacfbf015c81d8155d71f8776a32a6bcc6672035ac132f4071
MD5 37f952cf9ed9ee1ffe2a019a394d02f1
SHA1 ceb1bcfe4fb83aab0812cc1067c4763cca421b8b
SHA512 dd398bad88756dbb1cfa9f4f405c4efcbcf521f100edcd7a41ead6ce93fa644d8284566dfaa1238da5ce0fb90a65bb425187c8c4f5945343ab8b484662dc5af3
TLSH
T13D514D3303290AC1FF75CEBB70E024AAB2F59498350B6E1208517EF45807F1792E056F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 31e60650803a2299c8c4fdae7796fdd3378fce753fc7ccb79340992576091015
MD5 de4e146cd892f3426b41dcca6a8ae6a4
SHA1 cd14c57939264d04e07833a850943d094dd1a368
SHA512 88dbc388c889861dfb82009841aea25d2baa61059cf565955c6ee06e10bdcf07956d622ef255d5037ca3532cbe2e60cdad2073cfc8664ceec6b591533e4d318a
TLSH
T15251AFF3C2E8C66EC90156F0AA146E2BCE1D0915432C3D5AC9E4EF1B93E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 06511acd179242269e1e21cef091f99c843388fc3554bfd4b7f71b34dcfb1c0b
MD5 58a77f844f22f46c6a99dbd6e15e4958
SHA1 74ffaa0fe94b523c53ea1c7e6c41374be31c1b27
SHA512 3cc7f1788a4dcf4cc34490638003212b6346a16009adb408cb8c4bd47a635ebbdd22d14fc9b4442f1e5df55fd1c20ac513aaff6c201159642f61e59727280ce6
SSDEEP 192:sxRvgRyCO/fXs5AIZky1zoA8p4I/g6+WNIYbtZ6GG0IgVgJ:sxRvg/O/fXs5A2pY1/5IK6Sq
TLSH
T12332D9156A28A93B5CCBD21DFB65BF53D2F95032A1D41B58B6FC961C04EBADD120340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a456b04fcf2f8e4b455858619648cb4856133687fbcca2ebd7f1d8a8f9b5a0e5
MD5 df367d08d61917bc1f4c486e9f1d6058
SHA1 531f8489c09e06b76de09b7a696ed6cc76a21737
SHA512 fe181b72b295f7e35cee731b8cbadf5406fb08818ec51fe499bcc1d94232a923a8d226809f9f40c5e5b8b027be34e8624948ca1cab639b438a42acfabe115f60
SSDEEP 192:sxRv/RyCO/fXsRAIZky1zoA8p4I/g6+WNIYbtZ6GG0IgDpgJ:sxRv//O/fXsRA2pY1/5IK6SK
TLSH
T1CE32E8156A28A93B5CCBD21DFB65BF63D2F95032A0D41F48BAFC961C04EBADD120340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 00ce391f7f9ee7caa33d95504fd9a721409f5c9a4f06c5214f0a4f39387b050b
MD5 c3f9a14ce68323311aa8115ff6a7c6b2
SHA1 8b72b2a4c7fc51bede4421ac5dd615ba3420d55e
SHA512 f27d70a2b87a3428852dfe613f7f559facd00ce084110b52d81fbd9d146d92cedc327f133883af9a4f94bbcd3ef64c19bbc805c041b55208876b9146d6fbdbdc
SSDEEP 192:sxRv/RyCO/fXsRjIZky1zoA8p4I/g6+WNIYbyZ6GG0IgDDgJ:sxRv//O/fXsRj2pY1/5ID6S8
TLSH
T14D42C715AA686D3B5CCBD21DFB65BF63D2F95032A0D41E58B6FC961C04EBADD120340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 677420069bb2c54ffcbed0ed36855a555fbb19451a230cb08644140a25084ba4
MD5 a6355e71543ca01065f4a346ca40eb22
SHA1 49bf6e963de8393033fcc35e977d1820a9d80c7f
SHA512 0aacd9593a8658a8320a70cd6ea80a5732d833fc784ecfa14062179ba85daa95857e0c7e8841039e68cb0ddb914478a7561663c6f11acfec57c3897c36082980
SSDEEP 768:Fb1poD7pLuL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVhnpJ8IQroSSx:Fb1po1E7otWgikfq4u1jaqnpyI79
TLSH
T124D2DA3B240DCB7E5F804ADDEC197A9E6DA802CB96D8CD8047FA951C02C6BFB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e181890009e8a9b148dccf3514f520077197ad1d8b0468b800fcae3d2878c378
MD5 cb418e2083de441e4443d0291fe9a953
SHA1 98272ad6d2029ce9493c9e4f9f2c9ac08102710f
SHA512 db327cc9b74b1ce425e1bab7823ad062e8e9c8a684f1e3ab7b93a6e13ecc0127413f537f04b358a0620269a66e8c14ef26fac68a5e91c3dbccb71164969e7e28
SSDEEP 768:Drv+4UNbdu3ALtbBqobGL2/ytZu4aWADIidy8LuxR3t:Dbsbw3A5KtZzaNsuVLiD
TLSH
T1FA03A035F85ADE739CBAA284F1873A47BEF851A384C90AD4C4DD1B4E04874AD235BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b59d2cb2975b4c9116cdbd83fe048d421f0bb53e2894e19e51c4ba15b4862841
MD5 67e460d2bb1f92b00bb462774b2c76e1
SHA1 2a54474f2ad06e07e5a5cd4450333fc0ec3a6afd
SHA512 28247736b744dafda5d1575a5c174845f98e28b35a369c78682eaa912d1de29520ce4d0c4f257a2a20b20259f82055f5a3a4a76796ac440fae9697b6f2006eb6
SSDEEP 768:tf38LUbBwg8bNL2/vtZu4aWADIidy8LuxR3d:tf38CntZzaNsuVLiX
TLSH
T132E29E75FC579E73ACBAA284F2873B46ADF451B384C90AD484DE5B0E04839AD131BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6a1a49de453114db9e8767c1a923ca8fe32e0a0aa765818a671ed8a2f9d3e302
MD5 5bbc9f082e26ada08d435759f8b2c897
SHA1 f7244f3ccfaff152276593e1ba4b0d3f79286c56
SHA512 4a3cccab3b4338f27113c73fd2393e95b0ec1a9ec0d63cbab39ff4673734b522ab75103a26d22071ee9403fd797250d089d2cc524f0f820f03608a61c560e4df
SSDEEP 768:0B38LUbBqobGL2/ytZu4aWADIidy8LuxR3d:0B380KtZzaNsuVLiX
TLSH
T136E2AE75FC569E73A8BAA284F2862A47ADF491B3C4C90ED484DE5B0E04835AD1357C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 db2cf9188d55b18e6fbb3da0df6b54c8402960e844ac4b9f32b84a3b97da1fcc
MD5 e67133aaf92d7e42a749aa33dea0fb90
SHA1 3fb8f0507036ae0f583d49f4ae10e4692dca77f6
SHA512 eb9086f181aba24da355b179b76f8cbf3be3d79a0c856ba1e631dd7eb1210e60341fe05ac9a9e9bef78d12889ce1e94f79ca8471ee10ff409528dc0f0284be48
SSDEEP 768:9rv+4UNbdC3rzZBqobGL2LpZu4aWADIidy8LqfeVH1S1C:9bsbw35LpZzaNsuVLAEH1d
TLSH
T1D503BF36E869CA739CF79284B187760B7EF8916386890BE084DD1B4E42DB4AD1307E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1116_819198518\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download