e22854a5f93a9bce2c8dcffd9e177925074bb0e0972566d673e4b83022c9a46c

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m2-eL.svg
Size 3KB
Sample260812-tb8n1sysbs
SHA256 e22854a5f93a9bce2c8dcffd9e177925074bb0e0972566d673e4b83022c9a46c
MD5 735c5dd9687af27db46d1760af81d1a5
SHA1 0362449843acc75186d102a08af6cf07a5b90853
SHA512 26772d0a891c6a143982ad5a722edd3afac15222392ad8c66bec616770bd539ac0f223fe367a8615d39c4c5ff3ffbaccfd34400adc4c2fd98fac718edffb22b1
TLSH
T1AA71288876F83EEBD7D802970D41D4B84B2F946BD822978DD3CB94E875282AC735D570
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1292_1389807362\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1292_1013954536\_locales\lv\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6548	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310236587756339"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{7F5917D5-4B52-4624-B1E0-02371D98F726}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
620	msedge.exe
620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1292	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 1292	4088	iexplore.exe	90
PID 1292 wrote to memory of 4444	1292	msedge.exe	91
PID 1292 wrote to memory of 6528	1292	msedge.exe	92
PID 1292 wrote to memory of 6548	1292	msedge.exe	93
PID 1292 wrote to memory of 6528	1292	msedge.exe	92
PID 1292 wrote to memory of 6528	1292	msedge.exe	92
PID 1292 wrote to memory of 5700	1292	msedge.exe	94
PID 1292 wrote to memory of 5700	1292	msedge.exe	94
PID 1292 wrote to memory of 6672	1292	msedge.exe	95
PID 1292 wrote to memory of 4548	1292	msedge.exe	96
PID 1292 wrote to memory of 6672	1292	msedge.exe	95
PID 1292 wrote to memory of 6672	1292	msedge.exe	95
PID 1292 wrote to memory of 4548	1292	msedge.exe	96
PID 1292 wrote to memory of 4548	1292	msedge.exe	96
PID 1292 wrote to memory of 2280	1292	msedge.exe	98
PID 1292 wrote to memory of 3960	1292	msedge.exe	99
PID 1292 wrote to memory of 2280	1292	msedge.exe	98
PID 1292 wrote to memory of 3960	1292	msedge.exe	99
PID 1292 wrote to memory of 6084	1292	msedge.exe	101
PID 1292 wrote to memory of 2036	1292	msedge.exe	105
PID 1292 wrote to memory of 2820	1292	msedge.exe	106
PID 1292 wrote to memory of 5800	1292	msedge.exe	107
PID 1292 wrote to memory of 1600	1292	msedge.exe	108
PID 1292 wrote to memory of 1600	1292	msedge.exe	108
PID 1292 wrote to memory of 5920	1292	msedge.exe	109
PID 1292 wrote to memory of 5920	1292	msedge.exe	109
PID 1292 wrote to memory of 4212	1292	msedge.exe	110
PID 1292 wrote to memory of 4212	1292	msedge.exe	110
PID 1292 wrote to memory of 620	1292	msedge.exe	113

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m2-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m2-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe2057c188,0x7ffe2057c194,0x7ffe2057c1a0
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,4807438006740339691,4791054640836922704,262144 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
    3⤵
    PID:6528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,15284100614475036785,1350648729849318916,524288 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,1610947358985436269,5812402498050495047,524288 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:13
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,10870210657886782562,17128212945932153318,2097152 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:6672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,4045949240214027581,5472886739637667774,2097152 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,6347753378056446378,17278726159306325234,524288 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,14936975899317257121,3964858796072880440,524288 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,2069207918025106241,7411755860590989854,524288 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,2069207918025106241,7411755860590989854,524288 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,11858758036187666160,9907527854133647125,524288 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,10089489761431692531,9571792856422493407,524288 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,1351071559349383069,16086199783077803132,524288 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,5016139664626969909,8773210907738729777,524288 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:14
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,13720519028049738694,302402400967124860,524288 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,8732829937314748293,8955651520973215750,524288 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6016,i,3797327484367568473,15157204396372186867,262144 --field-trial-handle=2236,i,2871584694853704398,7962775506415134906,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 87c1029651f2ade75fdc605fc9d6a1d613555d1d89b30a110e84ec7906d37b7d
MD5 19dc9af48c61acc08e3c2f043ecf40c4
SHA1 8ef2e006216477bc3622b7312f0d22ac020f5c9d
SHA512 a71d97a854db7374dce99684d21586786c9c56d9e6ccd646d7a903082a63e010e44f5c062ca0d37c1bdd033df9b090f9bb022b16a0a78c97f2c0a78f728b7ed1
TLSH
T127E02B55C921BC271DFC2B1964540647EB80135B3B40894B7B3C81AC8FB06374286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 38f299c7ebcf1aa7743fc920a68424dd7451b6a9de7f59fa048470292de7894a
MD5 8974280860ecd951d75fcc0f897464df
SHA1 213ec182dd233aaa8d2b77b22bf1ef160f2f7a6c
SHA512 961ab9dea235355f41a04d5a2a06d2e2edcb2847245fa8ac36481731111139acbe3a40df65d1608d541120f8d4ba5c6a8872f4f4b3dec1f09fa94af665378147
TLSH
T15741C0F383F4856EDA1195F0AA186E1FCE1D0514432C7D9AC9E0EE1BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 461d96bb190e0614e23ad1df708ccb3c7ac9e4d5d71f3d685d778b711e1b6f59
MD5 3ed8e076f59d6e2b4b26450f23660ae1
SHA1 792b2a8d2b72c8f65b6029e1701fabe14c3cf13b
SHA512 da132569e2c759ba521830f81ddcdaef82e828ea7d84e8422b27483d59c9cdbc55ecfe66d86ad781159e9aa6500c1d6d56346286e82b9051816a012f25e8d994
SSDEEP 384:sxRbBqT9/fEsrqN/RI3DO/5IW48sGQUC+7Hu:snIT9/fTYWy/5IW48sGQUrq
TLSH
T19B72E915AA249D3B8CDBE619FA957F93D3F8117391545E44AAFCCA0C00E66ED211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1512cc9b6e7249deebc56ce76ddf8589c86691271c6911086f923576f384e226
MD5 cd9a095382173136eef55e4ac3a22cd5
SHA1 345fe2260f03ec1e8a29b028e1cfed6d9a949dc9
SHA512 ae01c18da7a58cd12348dba775831fadcb5c7b1e01af6fa8f9e86292413d4dc72b238d0a8b14a7c484211a2a965a7d6d43abd8e9641b143d3472d9d86809ea20
SSDEEP 384:sxRbB89/fEs3uN/RI3DO/5IW4csGQUCj1:sne9/fPcWy/5IW4csGQUy
TLSH
T17972E915AA289D3B8CDBD219FA957F93D3F81173A1545E44AAFCCA0C04E66ED211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 5f1392bdd089d357c049f2575994e3a01d4c40c33e69c65064565d6cf28a9680
MD5 50fd56fc775f2f2ce2cbb84563880b5e
SHA1 ed2d1981d74af4e7a415e42b8c15eb70be16ada7
SHA512 ca69572500c3692dcc570f702711efd78902d63e98fe43651b3a84d4fbd78e08c43cfae69df81f45f26ae33ec5ecf1c82e2c92c5e55e4a091b099a308f9b9d52
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhobbDwzrok4O:Ob4YZnE7yTWg1NfwBu1jaKobHwArO
TLSH
T19FE2EC3B280CCB7E4F804ADDEC29BD9B6DA801CF56D8895447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2fe25a7f877dbd9bce7f3939938b5cad7a34ea4362ae6132b1da71ab96f0af83
MD5 7ff443e14ca709069c1bf7cd9799da95
SHA1 d0bf87182cb055fe5af4f4bda13df79ad9b9c2db
SHA512 8b1595255e6c78eff2214141e656d7e8d19c82c40c8086358245e5a86850960454b43e7081f5560fd19dfd0e45844b9242fb9166eadb193de227a8978e4371e2
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EwtWSI+uxKbOq80B4jQozKONrUP:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRc
TLSH
T17BB25051713F4280387EB50C9178986F86C2B4637519E52F7BA802A65F6BE039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 28cb78dadb33fd782eccedf515d40b2313cf50a60abac267ef179421b2c22a78
MD5 2e494c07d5cf961ef825a1657f15ebb1
SHA1 59ec64d81ad9d7120a200f54a50ed86f87f80c9a
SHA512 043589d0c1253794ddfd10036fd89c4765c76e48698f1b1c88cb8fdd8353d7f9b829a53e99b01cee6006227e6dff38fe292d748a57bd273fbe552e9c675a52b3
SSDEEP 384:n8iFiZcIq8NL68TUNTUlIRpPvuTBfTEqfbYGO5GMeCZryzGMsRnlYr48LEEIzB:nFQqQ6wgHuViGO5deCxyGhn2ry
TLSH
T120D25C32DCA4CEB7ACFA4FD6B6497656DEE451A3848C9DC8EAC85D4C00875DE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 43f4b574e7f38a0345e79841166d513f2f3848955c29f8d209c9f2fcdfdd9a03
MD5 afd0e46ac85f6ca518c9060d1870f5c0
SHA1 31d5d59b33bbeeb877bef26fd16e251f7974cd0f
SHA512 d0501facb7ef7b3e498eaa460159bc823abd6c4d7a41108624e8a718bebd20db43f29001e1ec50fd994140343f5db2c7f77ac62b5ab14b7475f8192745de7b6f
SSDEEP 384:nWiFiZcIN8NL68TUNTUlIRpPvuTBfTEqfbYGO5GMeCZr9XGMsRnlYr48LEEIzB:9FQNQ6wgHuViGO5deCxNGhn2ry
TLSH
T1C9D24C32DCA4CEB7ACFA4FD6B6497646DEE451A3848C9DC8EAD85D4C00875DE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fadec99b2a77dadbbb2cfbc04802caf3b829980cef3c76cd7e710dd9c5643e40
MD5 d43d7bdd9595cdcc9d2f645a544ebfa2
SHA1 eb00b78b537ad2f161337d8f918fa6ba3ac68c12
SHA512 79a728101443bf271ff901251afc01a547f551479cd626e554c7f403b3b6b520e43f47cafe0e6562e90f5da306df81cf48d0cd1dae5f31a6e47bc5a350023bc0
SSDEEP 384:nkiF1tNn/s3n9Sn8NgN8TUNTUlIRiPvuTuiREqfbYGO5GMeILCOObjI9G6w7cd83:/F1j+9SXNwgUunUGO5deWC29MH
TLSH
T1F8C25B36E855CEB7EDE64FD9B70A7A1AEEE05263849C59C8EAC85D4C00C71ED0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6a79551c8e69c0c758f1398eadd8ba137a15749e08f7a0a65de93c3e1ce0d64b
MD5 2699ee0be4122e954e62d731cf28d158
SHA1 25f305e916b1d6530ee5e080a55f47f3613a24a5
SHA512 34b3701beaba7e66360b1369a1a78222e228f91d26f5a3adf6eafac50d53e2f7c2fb93165a16847f9aa315423375f531cf711ec4270e82307f28b5f8c7a7792e
SSDEEP 384:n5iF1tNn/s3n9Sn8Ng68TUNTUlIRiPvuTx8TEqfbYGO5GMeCZr9kGOObjI9G6w7H:QF1j+9SX6wgUuaiGO5deCxyG29MH
TLSH
T1E4D25C36E855CEB7ECE74FD9B24A3A5AEEE052A3849C5DC8E6C95D4C00C71DD070B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a837654364bd2fe6d1c2781e96c3e758b7ac0b91c0ee396502474676a0eeffb0
MD5 81ef41faab9bdcd8b8d0b9c92366156a
SHA1 1019885482de7e69ddef6424363cf0da4490ff1a
SHA512 3349cc5f2a07f72c33574f7a33325f478707cf0f7d47fb3ee1cef9b598940d03d68246551fa744b9e49a8031df72f584dd5340f0008ef15ee734c20383a5e042
SSDEEP 384:nCiFiZcIN8NL68TUNTUlIRpPvuTkfTEqfbYGO5GMeCZr9XGMsRnlYr48LEEIzB:JFQNQ6wgHu0iGO5deCxNGhn2ry
TLSH
T1D6D25C32DCA4CEB7ACFB4FD6B6497646DEE45163848C99C8EAD85D4C00875DE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download