2356f4f2b651efbad7c8ee7f8e4dcaa51b9ce28d95394fb3a5254447f93818e1

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v15O-m1-eL.svg
Size 44KB
Sample260813-thy36atdmb
SHA256 2356f4f2b651efbad7c8ee7f8e4dcaa51b9ce28d95394fb3a5254447f93818e1
MD5 2afb4097fb2218401ce6072aa93f8307
SHA1 faf6a9c1effa6293ec2021eac520dce00486f4e0
SHA512 f66dca04fa73cbae407bab6bcc97525d8d397ef065a220094ce93dcf717293611e9f00d05915fc2d4c5bd63b27ce5714f07b8b27c62cc32ab4efccf5b81dd84b
SSDEEP 384:c827NHdmDcvlxO4fnH5AomEkJW9mOx790u+wycg9+fiUCFRlg0vlg90rf2:c/NHMWaA90C
TLSH
T1CF1340B537F43C9B8BCC034B6D42FC6C46BF94B78458668C9BD790E89548368B7AC5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2760_2034754333\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2760_433850636\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2760_433850636\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3292	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311106592311422"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{D2D8DAA8-BA5C-46E3-80A6-DD4F58E59918}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2760	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 2760	4316	iexplore.exe	88
PID 2760 wrote to memory of 5704	2760	msedge.exe	89
PID 2760 wrote to memory of 3292	2760	msedge.exe	90
PID 2760 wrote to memory of 616	2760	msedge.exe	91
PID 2760 wrote to memory of 616	2760	msedge.exe	91
PID 2760 wrote to memory of 3728	2760	msedge.exe	92
PID 2760 wrote to memory of 3728	2760	msedge.exe	92
PID 2760 wrote to memory of 3728	2760	msedge.exe	92
PID 2760 wrote to memory of 5228	2760	msedge.exe	94
PID 2760 wrote to memory of 5228	2760	msedge.exe	94
PID 2760 wrote to memory of 5228	2760	msedge.exe	94
PID 2760 wrote to memory of 2620	2760	msedge.exe	95
PID 2760 wrote to memory of 2620	2760	msedge.exe	95
PID 2760 wrote to memory of 2620	2760	msedge.exe	95
PID 2760 wrote to memory of 2428	2760	msedge.exe	96
PID 2760 wrote to memory of 3860	2760	msedge.exe	97
PID 2760 wrote to memory of 2428	2760	msedge.exe	96
PID 2760 wrote to memory of 2428	2760	msedge.exe	96
PID 2760 wrote to memory of 3860	2760	msedge.exe	97
PID 2760 wrote to memory of 3860	2760	msedge.exe	97
PID 2760 wrote to memory of 6080	2760	msedge.exe	98
PID 2760 wrote to memory of 6080	2760	msedge.exe	98
PID 2760 wrote to memory of 4628	2760	msedge.exe	100
PID 2760 wrote to memory of 4628	2760	msedge.exe	100
PID 2760 wrote to memory of 2500	2760	msedge.exe	101
PID 2760 wrote to memory of 2500	2760	msedge.exe	101
PID 2760 wrote to memory of 2908	2760	msedge.exe	103
PID 2760 wrote to memory of 1512	2760	msedge.exe	104
PID 2760 wrote to memory of 1512	2760	msedge.exe	104
PID 2760 wrote to memory of 236	2760	msedge.exe	107
PID 2760 wrote to memory of 236	2760	msedge.exe	107
PID 2760 wrote to memory of 5012	2760	msedge.exe	110
PID 2760 wrote to memory of 6072	2760	msedge.exe	111
PID 2760 wrote to memory of 5860	2760	msedge.exe	112
PID 2760 wrote to memory of 3080	2760	msedge.exe	113
PID 2760 wrote to memory of 3080	2760	msedge.exe	113
PID 2760 wrote to memory of 5872	2760	msedge.exe	117
PID 2760 wrote to memory of 5872	2760	msedge.exe	117
PID 2760 wrote to memory of 2300	2760	msedge.exe	118
PID 2760 wrote to memory of 2300	2760	msedge.exe	118
PID 2760 wrote to memory of 4784	2760	msedge.exe	119
PID 2760 wrote to memory of 2600	2760	msedge.exe	120
PID 2760 wrote to memory of 2600	2760	msedge.exe	120

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v15O-m1-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v15O-m1-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffde6a9c188,0x7ffde6a9c194,0x7ffde6a9c1a0
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,9568414235631394748,4642549358788599121,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,15475751812025635366,18033830203437759223,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:13
    3⤵
    PID:616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,10271242505194739582,91324892815778458,262144 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,16565107219434582977,13927962989990070698,2097152 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,3839024756592935728,16195079785076355,2097152 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,18010106501679319717,10169073438270312752,2097152 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,12668353151403054859,17141130345039454084,2097152 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:9
    3⤵
    PID:3860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,14625739219502668246,12917350458324435084,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
    3⤵
    PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,11856665431621729445,10684321451066825214,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,8046237864475585121,12620949714875558936,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,8952972026752424037,16851107621748597940,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,8952972026752424037,16851107621748597940,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
    3⤵
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,2229170084683817486,4911708816953125016,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,15437102901062796024,5870706103063956737,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,11364417878469784129,3640552365911487283,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,9503760306769233133,11033992083375121157,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,3665945605867035495,14058844983699946766,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,13729414335199943414,17719954561497926385,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,10414176941665076882,1742821327990583810,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,190385057846512157,18433533538112812453,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6572,i,1105883874277242544,14635756626894734018,262144 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,14148801305637230925,4979959279770377158,524288 --field-trial-handle=2448,i,12124309468383523694,5842700941211749333,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
    3⤵
    PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 b7be32555849a4c3753cb7e6678176f8a37e4651c31707781d4b5bf824afa51a
MD5 eb22cf30f5e919dccf04c499e937fba9
SHA1 01362754733672d37a2160803a7ce149eb675e1e
SHA512 4ff8fffa2f3a7016dc6874de7c4fd0021458b83be9be0a498e2cd36c6492dd3ee2cac44ec3d6cb09f7e9e2d7550bf8209f80c87d3df84e6889eac27279d55aaa
TLSH
T10341C80CC36F18DCC725847EB3E98569363A92F8C183FEBCA0A069756807760E1F18B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e788.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e788.TMP
Size 2KB
SHA256 083b492cbab47e76da1c64b764940bc554e4be8933be98a478bcdf0d224dfbe0
MD5 579693aaee90e8e35d0abf74557320e7
SHA1 f05dbfd6df82dbe08180527514c218f7484e0219
SHA512 09f9c5f7c3a6b934c45c2945eaea7949fbd9c817a344cf04544a3d3ee08933d253e03b778e05de4634b02de8ade5c94afa52433d272ddb40cefa70b5959f0507
TLSH
T10F41B91CC36F14DCC725847EB3E98569363A92F8C183EEB8A0A065756807760E1F04B0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ad3ca2ab850062960a2c9180c3a136e1d6d9934f7da61e244ae813acda90a685
MD5 771379b2daa8c30c4d454fde8df21f59
SHA1 0da11887044e552334095ad544ccf768d8689dc6
SHA512 05c0e04c572389246bc00538a08b4d95202404456a8639744ab6284a603e0283e172c5b35c243ef7ad394f4e1bd9a716b4cf955463b64456a2237c368a360fe8
TLSH
T13541BEF783B4853D8E0195F4EA086E1BCE2D0515432C7D5688E09E2B93E3461D18199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2cb02ad84db96c302e2fb5c29cf0a34abc0fc70372667a4d610d8bc9e88b6d01
MD5 7f399d7af9dc0f5a4bcd00d8afe9d05a
SHA1 a037d59a40e5fb29fabaa38c2f849472bac66f54
SHA512 220c766af6eb614f5f05716820d61f41ae7c5be7a255a6b075dece5337436407af341f25c5ddb6ac055dd57bb50048d0559bc4137a1e2514a8a68bfa7dbdc879
SSDEEP 192:sxRD6RRC3/fLsa4qZj0GzoD8p4Q/g6+WNIYCNcuOjGpIgVUJ:sxRmi3/fLsa48LV/5I4Qi
TLSH
T12932C9156E28A93B8CC7E20DFB65BF53D2F95032A1D11E48EAFC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8218afd8d7e4ff2178753ac244b3937b16cd4601ecca2d93b9679f689f1a7af0
MD5 f32e5982758474c434b155f4770609b1
SHA1 b75cc245fffba6b0c71f2f8ccb4ca1b75183fef8
SHA512 ff0e6b5affba807e7b65b3a20a318f05d833537c35a6fbd44404674f78927c9d6dd06a5b92c48faae338127b79a564bcf81f7f067b9ef3d56ea0a34cd00475c4
SSDEEP 192:sxR86RRC3/fLs14qZj0GzoD8p4Q/g6+WNIYCNcuOjGpIgDkUJ:sxRBi3/fLs148LV/5I4Qx
TLSH
T19F42C915AE28A93B4CC7E21DFB65BF53D2F95072A1D11E48EAFC8A1C04E76DD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 517cc4a7c4146ae710bcc2e640f6bbdfc02e56d64e7ba418e033df976a392b53
MD5 802117219b9ff870d24f768adc5b584a
SHA1 05b19e851f7193f8b3dc33f07cd9afcaa59ad6ee
SHA512 aaca5c29866654ec79f0216e33fb424f8cb9a036dc5594028c04dee315cec3c0440d9bc97bdd76ebea7e9f65d299657936cc7420543f0b3876dc046b65521438
SSDEEP 768:jC+vvN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpL0QqctroZO:jC+vv7E7JQWgQ+f4+u1ja6L0VcGI
TLSH
T15DD2DB7B640DCB7F4F804ADDEC197E9F6DA802CB9698CD4047FA941C02C67EA521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f16ac713-0360-48cc-9664-4112257420bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f16ac713-0360-48cc-9664-4112257420bd.tmp
Size 12KB
SHA256 74682327943a636cdc9d97e046f66c2fda775c1bfa095f81cfc53cfc07176867
MD5 5f0d1d61423a65618026951143a97916
SHA1 02fcf56b77b9a15bf609ec38279d443b323ae874
SHA512 855499594d6dce12cab9da9dd41b7209c09361540b2a282160a72a097ccea2e75cd9115a8c69a634fab8666bc5633d89a4952f58fbfb1078a7af0acc9be80ee4
SSDEEP 192:sxR86RRC3/fLs1lqZj0GzoD8p4Q/g6+WNIYCksuOjGpIgDGUJ:sxRBi3/fLs1l8LV/5IvQH
TLSH
T1E342C915AD28693B9CC7E20DBB65BF53E3F95072A1D11E48EAFC8A1C05E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8241.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8241.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6d7c8cf0cf7b4ce67e33cf3849f9f58044d95b5dabdded3d835194acd46cb1a5
MD5 e5881a540c776414b322fbfe40b79824
SHA1 f11def8805c873148bef795d133e55d653bc1827
SHA512 a845e9aebc463e880e0440ee2d76a28b8435f5de84ab6ef21edc65625c2277e7d6c519ca185198bc68ef78e50e949e1b1e5c5999b408831d7d3b6e9d967e8116
SSDEEP 768:pFQD3nwgZetmsp8+p3bd66j+4BRv86aLIW5Pi9Pu:oD348+p3Z6n4ybP5
TLSH
T1E5038D72E8A8DA67ACF6DB81B3457747AEF411A395C45DD8E9C89E0D00871AE070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 be96fba5d31083513959e92690188cd16031fb133f90ce6a60e01807089ac490
MD5 ff33a6de9a53a2f9a85b0c9abce6c47f
SHA1 6512a57c80ee522806420fd551d59c85da00536d
SHA512 20e90fdf2a951f5a48670f634ee8ef905214ab34cbde1dc7c00ff31b40a14c584f62df0c37683a431b7cf2ff176f253b0c9a45f284fe448c6237943c7698b121
SSDEEP 768:c33n08OPUbp8+p3bd66j+4BRv86aLIW5Pi9Pu:c330a98+p3Z6n4ybP5
TLSH
T129F2AE71E8A99D639CF9D744B3463783AFF410A3A5C01ED8D8DDAB1D058716E170B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 fefbfaaa7beddad2dd23004022e3fac49ba42677999245b282997cd5dbf74409
MD5 91584f4d0e0c5bcc013cd5706519b37b
SHA1 a68f3d91e5d286e77b8deb3cdb1d3f860108bd39
SHA512 551d7c26c8a5d0a1cc7864698b5ff918d301a92706da091fbef67a9e3ba03101c920a64ca5531fe7b9eab783348834b95de233d545e9a7142db066ee6aeabfbb
SSDEEP 768:vrv+4UNbdD39cPUNp8+p3bd66j+4BRv86aLIT52bwCl1:vbsbp33L8+p3Z6n4y40ww
TLSH
T1B903BE72F4A9D9339CE6C644B1467B837FB811A399C10ED4E8D96B4E015A19E270FC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 eb513b283e26a8ef4a39ef063b7bdad9a693616ea082fd71949d146c62ad76ec
MD5 6b9e6301836a6709e8e76381a276d7bc
SHA1 e9ea305843448c6679c1ff36888d9ad62637c8b0
SHA512 e8e5a270e7ce2d12768e8f7e5e5bbaee987411f0109b8147b174dbd1a3555251f926fcff51cee746813c1b5c6e7100e0a34e8c07dee2d1d141268fec99d8563d
SSDEEP 768:Irv+4UNbdD3ccPZNp8+p3bd66j+4BRv86aLIiV2bwCl1:Ibsbp31L8+p3Z6n4yf0ww
TLSH
T1A003BE32F9A899739CF6C644B2467A437FF851A396C10EC4E4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 52a85f83e534ceddfdd7e35e8330ab459d17e442a4997158cfe80e180e7fc07f
MD5 d932a9838b63672eeb8d981c02f74240
SHA1 e44cd2f293fc6e81caf212c0c10e862476a6d5b3
SHA512 fd5fa614f698c6d4243395e064219ac660a931e50354667e83e996886583ac38b1d62a44e4e6edb702af0642789ddb188aff0348061b1fd73ddbf22c1bdf9953
SSDEEP 768:T33heOPUQp8+p3bd66j+4BRv86aLIW5Pi9Pu:T33Su8+p3Z6n4ybP5
TLSH
T1ECF2AE71E8A99D639CF9D745B3463743AFF810A3A9C00ED8D8DDAB0D058716E170B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_645367226\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download