66ba352347bb76d950affb07d51d3dc22a9e1e0e316488fd409ecb337f490e73

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m0-eL.svg
Size 3KB
Sample260810-e5zkwa1drf
SHA256 66ba352347bb76d950affb07d51d3dc22a9e1e0e316488fd409ecb337f490e73
MD5 95b7e2e1d8065db4ac2ce8927e95981e
SHA1 9f303ce03119c2588fcbb4f320794622c61045e5
SHA512 88d142db6604e75c03e021e409b771a60808f39568002c877a1bb39f1dcb57f89da8c819bd1a76d8cb929edd7c1405165884108a2abca02f298c6a497219887b
TLSH
T1E871268876F87EEBD7C802570D51D4B84B2F946BD822978DD3CB90E875282AC735D5B0
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4468_377720224\_locales\el\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7068	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308099430662687"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{3BE90F6B-8751-4096-B4A2-AFC22DD2A047}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6352	msedge.exe
6352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4468	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 4468	1240	iexplore.exe	90
PID 4468 wrote to memory of 5684	4468	msedge.exe	91
PID 4468 wrote to memory of 6176	4468	msedge.exe	92
PID 4468 wrote to memory of 7068	4468	msedge.exe	93
PID 4468 wrote to memory of 6176	4468	msedge.exe	92
PID 4468 wrote to memory of 6176	4468	msedge.exe	92
PID 4468 wrote to memory of 5024	4468	msedge.exe	94
PID 4468 wrote to memory of 5024	4468	msedge.exe	94
PID 4468 wrote to memory of 2624	4468	msedge.exe	95
PID 4468 wrote to memory of 2624	4468	msedge.exe	95
PID 4468 wrote to memory of 2624	4468	msedge.exe	95
PID 4468 wrote to memory of 5220	4468	msedge.exe	96
PID 4468 wrote to memory of 5220	4468	msedge.exe	96
PID 4468 wrote to memory of 5220	4468	msedge.exe	96
PID 4468 wrote to memory of 6664	4468	msedge.exe	98
PID 4468 wrote to memory of 4508	4468	msedge.exe	99
PID 4468 wrote to memory of 4508	4468	msedge.exe	99
PID 4468 wrote to memory of 6664	4468	msedge.exe	98
PID 4468 wrote to memory of 1756	4468	msedge.exe	101
PID 4468 wrote to memory of 6528	4468	msedge.exe	106
PID 4468 wrote to memory of 7040	4468	msedge.exe	107
PID 4468 wrote to memory of 6244	4468	msedge.exe	108
PID 4468 wrote to memory of 5844	4468	msedge.exe	109
PID 4468 wrote to memory of 5844	4468	msedge.exe	109
PID 4468 wrote to memory of 4992	4468	msedge.exe	110
PID 4468 wrote to memory of 4992	4468	msedge.exe	110
PID 4468 wrote to memory of 4340	4468	msedge.exe	111
PID 4468 wrote to memory of 4340	4468	msedge.exe	111
PID 4468 wrote to memory of 6352	4468	msedge.exe	113

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m0-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m0-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd3eadc188,0x7ffd3eadc194,0x7ffd3eadc1a0
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,12150575313974249091,4381828390388457672,262144 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
    3⤵
    PID:6176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,9707192611352896029,5116065593379620060,524288 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
    3⤵
    - System Time Discovery
    PID:7068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,2601815614531003540,1069358495280069111,524288 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,243632190425860232,15810952977095381892,2097152 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,4304683878576704009,15274107983714902554,2097152 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:1
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,3252155724068814499,16029813554532076942,524288 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
    3⤵
    PID:6664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,16479353480336153209,8016059488527536312,524288 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,9888249799872718532,7403018604527678397,524288 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,9888249799872718532,7403018604527678397,524288 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,1589675719902455069,2749113515611887713,524288 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:6528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,4891920725229656596,6981697510759446368,524288 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:7040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,17582036906993918638,4673770957294268076,524288 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
    3⤵
    PID:6244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4032,i,16147203618674415863,7147609157158189802,524288 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2716,i,8606937988974922961,17319473118211522120,524288 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,15642738404526866200,687965915339794976,524288 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5192,i,10824864689764394837,9982011792963511698,262144 --field-trial-handle=2028,i,3810645988493548502,12386301506049792189,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bcef53a37770d8db13f5d73462a1108c42435456d5ddb93235ac46bd18b9502d
MD5 a7ef1a1d2c7b34e32b8303183e41f5d0
SHA1 5ddfafd8b7583fecd708a8f59724f2f744f85a90
SHA512 b2cd77908c8851ede673ed8ffeed73fcc034939e6c41ada299ee9179cc1c000928af58f399ae8b7d300b80acb9fe9877db90969953bd2c84b7165f999dbf2fd9
TLSH
T117E0E595D924B82B19FD1B1861544646E751135B3A51884B3B3D826D4FF063B468A85C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ba5a88effa6214626d90c932292613d36d8c7072c3c60841f7d4af1cfc7625dd
MD5 bcc73acfd22030b37174005815094b85
SHA1 2ad169ea5ae669a0f1d2a9befc2092942097859f
SHA512 c1242db9a6bc270e68cb8d561ea69bc09c0852f4a733eb1b471ca1c06ad239405364658abd086e3812da44db97889c522b0c3297eee176822607afaf644595f3
TLSH
T10841C0F783F4856ECA1196F0AA18BE1FCE1D0514432C7D9AC9E4AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 806fb1049853fbfa72ee948e3d2c65ff3b0ff839ba78098964c3268e176468bb
MD5 8956c1191b581e11cd8cc3bc3744cfae
SHA1 7908edca4088805e16baed5aa0c986505a520df4
SHA512 4d895d83f4282cc35ef6fe0a18b372a7ced6f15d008686ab22a577409b86ae96e87b68c6ff1745a30164dd93234a2c9dbe2770590f24294a8fa9b958f9bf6e3e
SSDEEP 384:sxRwP8Q/fgsJPCN/RImg0/5IW4jsGQ5jb:sUkQ/fVgWu/5IW4jsGQ9
TLSH
T17472FA056A289D7BCCDBD619FA567F93D2FC1173A1505E44AAFCDA0C04E6AEC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9ff4cf403a0877470c0a36fa417900b72eafe6018dd51387aee5cc1976397abc
MD5 1a0ddf1e7e4e4a075d2d58286a4e5774
SHA1 d24f432944c7ca272fd98bf5d8342a62318971e1
SHA512 a4a3fcfa7d32ba5632cf887fee1ff8dd4e8e0810eab1df53cb491beaa87acfd551aa814edfc846af6a2d579c512c153e678776069ec433445f27be46f999f179
SSDEEP 384:sxRwPqAuQ/fgseP2N/RImg0/5IW4JbsGQ5Y9:sUyAuQ/fS0Wu/5IW4JbsGQu
TLSH
T1AC72E815AA289D77CCDBD619FA467F93D2FC1163A1505E44AAFCDE0C00E6AED211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 872395ee87650a64cf8ab6c563cee15668e692c78e0fc350ba94f96a0bf18a92
MD5 a04bdfd34b2fca1a3abf7d17fbf0cfc6
SHA1 904cc7f9b7c4cbfcdb27ffab2dd4f17ab39c784a
SHA512 77bad33bcdbda128925ef4ba7b3ade132238ccf29371a2ae7ec42310cb30feff37a6ba4045b128d1618deeb09971f058445e2f176f3e1135f76975b13e2ced38
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYobbDwzroB4xS:Ob4YZnE7yTWg1NfwBu1jaHobHwA2xS
TLSH
T148E2EB3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f664b68b65b807861910791097054323dafc7e1f9aa96a716e1a496cc9fc3d89
MD5 a35aee187f3d8ba2029bf1226b93cc88
SHA1 4a3d7365582d5f5bc34b40cc0e786c88cc09f664
SHA512 ba251cb848b59b0091f1bdc5fe2faf0c42ad951102767d6a4de7c3c477efa4d68b4e16bc373e24f88d867ff513afab5d92759f8c85e0021396e2cb2b610a451a
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9ftD:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRY
TLSH
T139B25E11713F4680383EA90C91B8981F96C2B4637519E53F7BA802A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c26f602b179c57e0682b4268a7cb838ac01f5d68e093a121f8a511b9d8555568
MD5 d429592af81176e85d336913ce11dc3b
SHA1 4d9fed1b71c128c8f07112261eb3fe5a61445d7b
SHA512 fe4366ac079e588ca6d07afafcb51b31952bc0602cf52da09592af3021fb40f3b81cdee44a8b2f35154f9f5a8efe2e36d537df6edd52f04d2c997a4fc72265f5
SSDEEP 384:n6iFiZcIm8NL38TUNTUlIRiPvuTRWp5wrWfk5Hpij6P57ClAcaTey2v0LC6Hlyt5:xFQmQ3wgsuYW9HQmLTey1Coy6Dq6Wv
TLSH
T114D27C31D8A8C977EDFF4E95A64A7646DEF4122395D88ED8E6CC9D0C00872DE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d5f5c8c59cfa76cdb7816d5541935aee70cc41866a5d7cf89d8da3f09818a78d
MD5 461a161cc00bbcca12195dfb066c663b
SHA1 a6b3441ba7790b8f711d066e0c457766426798e1
SHA512 ccb05afe61938ed04af200834df1faf7d257cc3c8ff8c01fe89b515c295dd59a9f9de33e3be495531b1ead2de2a433334c464a078878b67e14634793256ce15e
SSDEEP 384:n7iF1tNn/s3n9Sn8Ngm8TUNTUlIRiPvuTuvREqfbGGj6P57ClAcaTZLFOObjI9GK:WF1j+9SXmwgUuiqGmLT1F29MW
TLSH
T133C26B36EC59CEB7EDE64FA9B74A7A4AEEE00267849C59D8D6D85E0C00872DC0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 086e6aafefba0d9b6df4574a8f011fe1caff162d5598d36a44e203489f655012
MD5 428a7edb8ee210407941cd8aa2d29d96
SHA1 adee06c2e2729587679f4761fe55cdcf91768f73
SHA512 f5b65043d651e82f7a38b496d3baf5a455f2b16335ae83fc6397395d15ce0136a8908b15c7a91df3b70d77838d1e3b2ff5cee59fbff86f22a10497d4bc8ccb3c
SSDEEP 384:niiF1tNn/s3n9Sn8Ng38TUNTUlIRiPvuT9+pEqfbGGj6P57ClAcaTey2vSkCOObS:pF1j+9SX3wgUuIyGmLTeyWC29MW
TLSH
T18AD25C36E859CE77ECE64FA9B74A768AEEE41273848C5DD8D6D85E0C00872DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c1f81dc8eae33a7ca67774f70a55ccd2f4629311a141b9f1319b97b793cc487e
MD5 f424c6502e8150d164cd337b482b60bc
SHA1 e8636e944c2b55771fec7633a5440a58ad9491ec
SHA512 bbf054c3ebae6c6f2cc2fc7a5e13ffa540d07b542e2e24e6fb5de13b02c56a8787bdb63b76826dfa3dc76ebdedb8c6411f684e3c1df43b9a299d5e165bee33d7
SSDEEP 384:n/iFiZcIK8NL38TUNTUlIRiPvuTRWpEqfbGGj6P57ClAcaTey2vSfC6HlytEDq1Z:KFQKQ3wgsuYyGmLTey1Coy6Dq6Wv
TLSH
T14ED27C31D8A4CDB7ECEB4F95B64A7646DEE41123959C8ED8E6CC5E0C00872DE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 de75d23255b9388c208c7af4392e2f24099755773df10d9d36197e92838bc16d
MD5 5f9cc0af44843e450fa5f9c6467b5b1f
SHA1 19663f210742fc1512282593fd609d760780196d
SHA512 d20ab6f2d9afef7d74da369c2064234ed890568fd771553a77fc2f0d3884da9e9ce3ce68cb30a00c6d69c4ec7509049dd85644b1dae3b84f08fee0ad054c1030
SSDEEP 384:n5iFiZcIK8NL38TUNTUlIRiPvuTRWpEqfbGGj6P57ClAcaTey2vSfC6HlytEDq1Z:QFQKQ3wgsuYyGmLTey1Coy6Dq6Wv
TLSH
T122D27C31D8A4C9B7ECEB4F95B64A7646DEE41123959C8ED8E6CC5E0C00C72DE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 3e0cd153e8b8f4955798bb00d0bb5b4d1f6a9914443fa59c6d99492850cfbd25
MD5 f68bf289f15f158842d49754d9284696
SHA1 55b75353272d429e349676c11f6e89769be17b6f
SHA512 7ddb16b5ec01e0ada7395a3cf84955d93c88c3dfe75b1894ead90fcf06499c54ad2e3f3281aa7d4bdf6709e74eced419f0d7667947ff5be806ec49b296e41642
SSDEEP 384:n/iF1tNn/s3n9So8NL38TUNTUlIRiPvuTJWpEqfbGGj6P57ClAcaTey2vSfCz8jv:KF1j+9hQ3wgsuIyGmLTey1Cz84a
TLSH
T1CEB23A32E865DEB7ECEB4F99B74A7686EEE4116384889DD8D6C85D0C00C72DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download