66ba352347bb76d950affb07d51d3dc22a9e1e0e316488fd409ecb337f490e73

Analysis

max time kernel
148s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m0-eL.svg
Size 3KB
Sample260814-xlc7msgj31
SHA256 66ba352347bb76d950affb07d51d3dc22a9e1e0e316488fd409ecb337f490e73
MD5 95b7e2e1d8065db4ac2ce8927e95981e
SHA1 9f303ce03119c2588fcbb4f320794622c61045e5
SHA512 88d142db6604e75c03e021e409b771a60808f39568002c877a1bb39f1dcb57f89da8c819bd1a76d8cb929edd7c1405165884108a2abca02f298c6a497219887b
TLSH
T1E871268876F87EEBD7C802570D51D4B84B2F946BD822978DD3CB90E875282AC735D5B0
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_937122935\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_378244418\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_378244418\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5404	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312073822820280"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{EF2688A1-7158-4C21-8F8A-5A76C6B9CCF2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5904	msedge.exe
5904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1244	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 1244	3576	iexplore.exe	89
PID 1244 wrote to memory of 5636	1244	msedge.exe	90
PID 1244 wrote to memory of 2700	1244	msedge.exe	92
PID 1244 wrote to memory of 5404	1244	msedge.exe	93
PID 1244 wrote to memory of 2700	1244	msedge.exe	92
PID 1244 wrote to memory of 2700	1244	msedge.exe	92
PID 1244 wrote to memory of 836	1244	msedge.exe	94
PID 1244 wrote to memory of 836	1244	msedge.exe	94
PID 1244 wrote to memory of 5816	1244	msedge.exe	95
PID 1244 wrote to memory of 5816	1244	msedge.exe	95
PID 1244 wrote to memory of 5816	1244	msedge.exe	95
PID 1244 wrote to memory of 5776	1244	msedge.exe	96
PID 1244 wrote to memory of 5776	1244	msedge.exe	96
PID 1244 wrote to memory of 5776	1244	msedge.exe	96
PID 1244 wrote to memory of 5772	1244	msedge.exe	97
PID 1244 wrote to memory of 3376	1244	msedge.exe	98
PID 1244 wrote to memory of 5772	1244	msedge.exe	97
PID 1244 wrote to memory of 5772	1244	msedge.exe	97
PID 1244 wrote to memory of 3376	1244	msedge.exe	98
PID 1244 wrote to memory of 3376	1244	msedge.exe	98
PID 1244 wrote to memory of 3676	1244	msedge.exe	100
PID 1244 wrote to memory of 3676	1244	msedge.exe	100
PID 1244 wrote to memory of 4364	1244	msedge.exe	101
PID 1244 wrote to memory of 2084	1244	msedge.exe	102
PID 1244 wrote to memory of 4364	1244	msedge.exe	101
PID 1244 wrote to memory of 2084	1244	msedge.exe	102
PID 1244 wrote to memory of 2768	1244	msedge.exe	104
PID 1244 wrote to memory of 1004	1244	msedge.exe	107
PID 1244 wrote to memory of 1004	1244	msedge.exe	107
PID 1244 wrote to memory of 2580	1244	msedge.exe	108
PID 1244 wrote to memory of 2580	1244	msedge.exe	108
PID 1244 wrote to memory of 956	1244	msedge.exe	110
PID 1244 wrote to memory of 5968	1244	msedge.exe	111
PID 1244 wrote to memory of 2940	1244	msedge.exe	112
PID 1244 wrote to memory of 960	1244	msedge.exe	113
PID 1244 wrote to memory of 960	1244	msedge.exe	113
PID 1244 wrote to memory of 6000	1244	msedge.exe	117
PID 1244 wrote to memory of 6000	1244	msedge.exe	117
PID 1244 wrote to memory of 2060	1244	msedge.exe	118
PID 1244 wrote to memory of 2060	1244	msedge.exe	118
PID 1244 wrote to memory of 5904	1244	msedge.exe	119
PID 1244 wrote to memory of 1284	1244	msedge.exe	120
PID 1244 wrote to memory of 1284	1244	msedge.exe	120

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m0-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m0-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffa3676c188,0x7ffa3676c194,0x7ffa3676c1a0
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,6931386291875558713,9128837709547743398,262144 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:2
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,7062726804918725756,5753088515928841961,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,17286120831344367449,11313925191765130915,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:13
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,10956173256995643713,4461703494095593508,2097152 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,12008549362700136614,18116818785519489011,2097152 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,4724653211677975754,3643449925518753769,2097152 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,17158549024172782225,13554348178917142606,2097152 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:9
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,8519373885732441477,17567166740390007173,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,18188978030208677680,16814777956184116227,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,11215029772167296364,10603985113079776693,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,5078234900263328819,12400039309820843259,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,5078234900263328819,12400039309820843259,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,9822622963098686752,12699367687356958921,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,17842599014720460002,2631028700059803068,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,9003429008520629547,16224473288776496258,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,239468387698348130,3972919066734681272,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,16149050516863600585,8278605854255105693,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2856,i,3820455365712243884,1032413081951205440,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:14
    3⤵
    PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,8110986620971843280,9481205896453668535,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,337805328609261934,6706978432101939654,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6588,i,11729923808304325638,16285996126553433462,262144 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,3501681229681122846,16953611739229901180,524288 --field-trial-handle=2984,i,6549585049004583173,1738702478606823076,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
    3⤵
    PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 6198cf165715c84bb79ff94396ddaf9269eabf7052fa7d447791be576ab2c5f5
MD5 8575aa2de230ba7e5c8aa1f3913ede72
SHA1 b890e0cc4696b015b9b1a9da80115e17ef536d10
SHA512 16be7e2cb8c8215982092d218bd37ca1429176b9b5e0d0037ad24ca040c74a7e5ae2039cacc223b4baada16de2dc916a5ed07007bd2238e85600199c0fb646db
TLSH
T1924185383333E5C1CB60E5F290E566953235F14A1B0BBF9370456EF88886B2C43B0E64
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59769d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59769d.TMP
Size 1KB
SHA256 121478ed9c2dc36f337f0dfcac6ebcd97340faf512ad36af2662023f0ca5c122
MD5 843050821f45d65e9b0875841a5df455
SHA1 d40c0c45a2832363507159673bfbc7f5641871ec
SHA512 0c19c52d0ca9db7b1bff4aa2e907f448977f42fcab5443476c336b8afb9cc14986129a788a9a20b84050ee0bdfed8c4224beabc01b4ddf2732ef253366965b4f
TLSH
T1584185383333E5C1DB60E5F290E566993234F14A1B0BBF9370456EF88886B2C53B0E64
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 883c61553c7c7e63cbce3980d087b5d7bd9d0965e5f57ec9b3a56f81e19601ee
MD5 707909b594e0d448020e567d29d4b951
SHA1 122baa2dc131678d54454fe6969595b6820d6d4c
SHA512 5129ef72f3bb447b745e50f5a1058cc41c1337ce18a0e917c489c916c8cfca4ab9d1491469c3bfa11e7d2dbeaaca0de3846d48e930f23f48947d6b6239673959
TLSH
T130419EF383F4857E8A0156F0AB146E1FCE2D0555432C7D5AC9E4AE2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3a498d00b9bf4d7b0c95edb7102a74326e7a9543d4fe5afa5c81016c34e8d61a
MD5 47e05d6c861e510d8c9afe7f9b408202
SHA1 502d69524c0e87cdc9bb438427ec7bc44169187c
SHA512 c9403a66adc16bc710166526f10a3695556b7ff9c38aa68585b92b8989e17793a357e7ca568383457d7b45f3848b15a8ff9619781a0fa55691342e665340680b
SSDEEP 192:sxRaRdyM/jK1Ml8wCo/f7ssjELZT2lzoA8p4W/g6+WNIYbCaZ6t+GBIgVXJ:sxRaf8o/f7sswlTZb/5IE6t3P
TLSH
T12662E9156A389977CCDBD30CFA567F53D6F81173A1901E44AAFC8A1C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 38dc5bf79aae904827ad8223a0ced7559f00681300a1d2825b21614ac4374d5c
MD5 02259fccd335198ac8bedecb7cdbbf58
SHA1 ca34adb4681c8d049e805ce6688b8fe8e920f72f
SHA512 512edce43224bedbfa1c2340590cc9ba4eefe544308f4e8afd47058a26778ccb36b6f51f177af8dc11487333ecc7763b51ac389d9b8b13b6024851140d1275d2
SSDEEP 192:sxRlRdyM/jK1Ml8wCo/f7sHjELZT2lzoA8p4W/g6+WNIYbCaZ6t+GBIgD3XJ:sxRlf8o/f7sHwlTZb/5IE6t3V
TLSH
T13762D815AA3859778CDBD308FA567F53D6F81173A1901E44AAFC8A1C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a853216aa2cf13e61dec20638498593d996c2b8ef6b3f9cbc8791631aa4ce8bc
MD5 219148128fc0f26afeef8e2b32f1317e
SHA1 fc9b2728048a48aa16e810d924d5f31f7bd09f64
SHA512 57066930da2f51a7b6d7b19c92fb870e149f8ff507d8bdf9dc93d71f376e37deec43277a469f9621f4a537e8ad7f9139d2a01d9e4f984f118d56f579faa3695f
SSDEEP 192:sxRlRdyM/jK1Ml8UQXCo/f7sHjhLZT2lzoA8peW/g6+WNIYb1AZ6t+GBIgD1XJ:sxRlfqSo/f7sHFlTZB/5I56t3b
TLSH
T16062D815AA389977DCDBD308F6527F53D6F8147391941E44AAFCCA1C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4710b96f8084332ffb6008b2cf62d71b01298a2d7b207e18fb6262978045bfca
MD5 e5b64b9fd609059fac62632407363700
SHA1 5d10bc8af32a740ca92427c9b3dbb5f3ca32e1c4
SHA512 96a85e84b273d0aa62a55e706715bdeabb8d30f336a0cdc687eefe2833c3e211b71d9ac2b54e7ed4acd7a05b39fca62873b2da306cb558a2c3e9f2723b40199a
SSDEEP 768:FW7ptD7pLuL70tWgikfn48F1+UoAYDCx9Tuqh0VfUC9xbog/OVWCBJ8WZrogZWkF:FW7pt1E70tWgikfn4u1ja1CByWS6PF
TLSH
T1AAE2EC3B280CCB7E4F804E9DEC29BE9A6D9801CF96D88D9447EA490C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 046f99447c61aebb82b68ac604bcad78826eab7ec3b557f88af5c590f1994a9f
MD5 d478af1b36d8d0d00c5146dce3b48cae
SHA1 4469da2eddd6e98210498798951c2d8bd5c7bfe5
SHA512 dcf47aaa7665eeba320dfb68f9435bc8201c7f2979e4b571f06cd3a24303ba71104913452490c5a40ce580d771036374c55446f81ff41c19fe1dd211a58b9f0f
SSDEEP 96:KRCHuC0UECWMZxgyCK4ngoCcSaBgCrH+zC+4AwmWgFNg+mK4jg8mc2eds95qKqwk:CCHuC0UE9MZSy6ngoJSaBgCrH+zC+4AC
TLSH
T138915311357742C03DBEA55890B9852B92C170A7722CA43F7BAA41628F6BF435CFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1212.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1212.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 98764170f8e0ce9fa5d9405dcc6de22db812ef5beea04213a8503558f5e4e757
MD5 536fc1fa895628871761849a100c7430
SHA1 cdd7722dd0e71bfdf37b1337ae40f219e68b977b
SHA512 c90f15e50dc65d670f0e6751b90bf66c88a9811337bb7ce44cc7b8668ec57ce0775582bcea9877a17befadc5fb8483193c6f18d0af3994d4122faab9aa97747f
SSDEEP 768:Jrv+4UNbdT3ynBtBqobGgvZtZu4aWADIidy8Lupl:JbsbF3CtZzaNsuVLyl
TLSH
T10203AF75B86ADE739DBAA244F1473A477EF451A384C90AE8C8DC1B4D04C74AE231BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4d9e67bead46e26f655206219844c05846536b991f147310e99d0ab20ff0c183
MD5 be657a32248d8464b14ac19848911b2c
SHA1 6ede9785d5a9881586cb0c75bb707c7f6c2fa1c8
SHA512 2575a16c2061546466fcddbf973bcc582a08e047880b268cbbc04e8244f8641534689cfd3fb22ca54cbd8cd3c09f4ea5d776c2a6555ecf93c34a567cfb32236f
SSDEEP 768:Trv+4UNbdC38GbBqobGgvhtZu4aWADIidy8LbpeVH1S1C:Tbsbw3rtZzaNsuVLVEH1d
TLSH
T16D03C076A869CE739DF76384B1877A4BBEF8516389850AD4C8CC1F4E05874AE130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 273ba7a04a8e5e5d740bf33113030819505239780bab3e8972c4c7506dab36e8
MD5 11f4bd38b0b3fba912670a49a4a1643e
SHA1 dc31c1a52177d84c587cd1e465ea73b63460952b
SHA512 c1cc8cdb1db5c7c466ad9328e6fdc327f7d45926e09af081e32ee4f3f1b0f05cd40a5d0e69d03680aa8ec3feab6f7c46357994ba3372725f20edb51ef919742b
SSDEEP 768:/A3ynZtBqobGgvxtZu4aWADIidy8Lup8pJ/rhlu:/A3etZzaNsuVLyoJ/rhA
TLSH
T175F2AFB5BC69DE7398BAA244B6832A47AEF89173C4C845D5D8DD4B0E04C35AD131BC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9cf5142e8d909d6644fce7b91817e6eebd30b4139a22eb984177946fd084bef1
MD5 01c11c10bd47ac0f811d65c25b339db3
SHA1 a32f037e8e93a72a7828ee215123dedd71332bff
SHA512 84987ae4774ea3e1f2584b03b916105dc494641faf9348f5324d5ee1194eba4eee53a7fcdfe2c1014fdb3fa8c11ac6dd7ee3a240160463c2a2aa7cd9710ec847
SSDEEP 768:9rv+4UNbdC3c+qBqobGgUpZu4aWADIidy8Lqi3eVH1S1C:9bsbw3BpZzaNsuVLJEH1d
TLSH
T17703BF36A869CA739CF79284B18776077EF8916386880BD4C8DD1F4E46DB4AD1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 df2262948360ebd3dd8fe994a00ed6bc7e2ffb470c51aef6fc52997bfa709c6c
MD5 6c830b5ce2c4004b71e2e0f18160476d
SHA1 16859f1311375125fd4a8b9070e9f69c4006de40
SHA512 5099929d28e874a9791ddb9db2e7fd31f965a51c42598a1572120d51373e87d9ca074ef5ec374d54ddcfae3d10cd09fe66933fc88f6980650f2ce1c7623a3950
SSDEEP 768:4A3XnZtBqobGgvxtZu4aWADIidy8Lup8pJ/rhlu:4A3NtZzaNsuVLyoJ/rhA
TLSH
T121F2AFB5BC699EB398BAA344B2832A57AEF89173C4C845D5D8DD4B0E04C35AD131BC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6374f340430102804e3b09f291e90009d12bdf418033974abcf7716672bff7ec
MD5 90a752a28fe20a2fa09af8c23771e72d
SHA1 ffe97d63833a6b00b8ff6103e644ed00e4e0c02a
SHA512 71733c4d264c3d7ea9745df3ae19fe17269bb114dc574757d3156cbcc3e985b760b31efebbc733ceea31643d7788931328f9b516a312437887ca9898bf5f89db
SSDEEP 768:YFQ930wg4nZ+4vgvLtZu4aWADIidy8Lup8pJ/rhlu:793atZzaNsuVLyoJ/rhA
TLSH
T196038C7AE855CE7BA9F6A785B7463A4BEEF451A3C4C889D5D9DC4F4D00C30AD030AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

f03ba173-c1a6-4599-8391-315cdb6b7942.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f03ba173-c1a6-4599-8391-315cdb6b7942.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download