f8b98cd5d49b002dac12197f3cc48586c13811d7c326a008e2abc1ea27d94bab

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m2-eM.svg
Size 3KB
Sample260815-2tesnavdnf
SHA256 f8b98cd5d49b002dac12197f3cc48586c13811d7c326a008e2abc1ea27d94bab
MD5 40ed26c24cc55b701d2198147f4dd511
SHA1 be79a6dd7f18c178a4419eb98dd433ab090071d7
SHA512 6640d83ea0c3300598f061d3914e839c94e0dec416692dbed5dc1e857898e7467011e2e986cc39131cb59505b3705d679faa8e61cff117e12fc356edaceed39e
TLSH
T10271378876F87EEBC78802970E51D4B84B2F906BD822978DD3CB94D8792C2AC735D570
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_474755173\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_474755173\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_611151522\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_472832220\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_989512905\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_611151522\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_611151522\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_611151522\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_989512905\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3424	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313079395565480"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{AA641A62-C091-44EB-96EC-10D12339B2D2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3360	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 3360	2716	iexplore.exe	89
PID 3360 wrote to memory of 6076	3360	msedge.exe	90
PID 3360 wrote to memory of 1736	3360	msedge.exe	92
PID 3360 wrote to memory of 3424	3360	msedge.exe	93
PID 3360 wrote to memory of 1736	3360	msedge.exe	92
PID 3360 wrote to memory of 1736	3360	msedge.exe	92
PID 3360 wrote to memory of 5916	3360	msedge.exe	94
PID 3360 wrote to memory of 5916	3360	msedge.exe	94
PID 3360 wrote to memory of 3400	3360	msedge.exe	96
PID 3360 wrote to memory of 3400	3360	msedge.exe	96
PID 3360 wrote to memory of 2696	3360	msedge.exe	95
PID 3360 wrote to memory of 3400	3360	msedge.exe	96
PID 3360 wrote to memory of 2696	3360	msedge.exe	95
PID 3360 wrote to memory of 2696	3360	msedge.exe	95
PID 3360 wrote to memory of 3808	3360	msedge.exe	97
PID 3360 wrote to memory of 5112	3360	msedge.exe	98
PID 3360 wrote to memory of 3808	3360	msedge.exe	97
PID 3360 wrote to memory of 3808	3360	msedge.exe	97
PID 3360 wrote to memory of 5112	3360	msedge.exe	98
PID 3360 wrote to memory of 5112	3360	msedge.exe	98
PID 3360 wrote to memory of 916	3360	msedge.exe	100
PID 3360 wrote to memory of 916	3360	msedge.exe	100
PID 3360 wrote to memory of 4384	3360	msedge.exe	101
PID 3360 wrote to memory of 3180	3360	msedge.exe	102
PID 3360 wrote to memory of 4384	3360	msedge.exe	101
PID 3360 wrote to memory of 3180	3360	msedge.exe	102
PID 3360 wrote to memory of 2184	3360	msedge.exe	104
PID 3360 wrote to memory of 5328	3360	msedge.exe	105
PID 3360 wrote to memory of 5328	3360	msedge.exe	105
PID 3360 wrote to memory of 1476	3360	msedge.exe	108
PID 3360 wrote to memory of 1476	3360	msedge.exe	108
PID 3360 wrote to memory of 1868	3360	msedge.exe	110
PID 3360 wrote to memory of 1196	3360	msedge.exe	111
PID 3360 wrote to memory of 5912	3360	msedge.exe	112
PID 3360 wrote to memory of 4896	3360	msedge.exe	113
PID 3360 wrote to memory of 4896	3360	msedge.exe	113
PID 3360 wrote to memory of 2360	3360	msedge.exe	117
PID 3360 wrote to memory of 2360	3360	msedge.exe	117
PID 3360 wrote to memory of 4304	3360	msedge.exe	118
PID 3360 wrote to memory of 4304	3360	msedge.exe	118
PID 3360 wrote to memory of 3568	3360	msedge.exe	120
PID 3360 wrote to memory of 3180	3360	msedge.exe	119
PID 3360 wrote to memory of 3568	3360	msedge.exe	120
PID 3360 wrote to memory of 3684	3360	msedge.exe	121
PID 3360 wrote to memory of 3684	3360	msedge.exe	121

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m2-eM.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m2-eM.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff244fc188,0x7fff244fc194,0x7fff244fc1a0
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1996,i,8239049357822100918,2115810253576391271,262144 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
    3⤵
    PID:1736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,7487775695664636161,7782971933239451543,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,5197843351145219781,11178372497551793691,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:13
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,6366683693242640747,6252454690453369448,2097152 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,2615312854658591541,1549325823843918644,2097152 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,11501833582645552293,8138297240201893126,2097152 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:9
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,1619574723374543649,7872038173589780160,2097152 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,14740965953402486619,1871877458817704775,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
    3⤵
    PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,6355436292986220832,12764785393957129518,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,8294314448657702175,9941433136857005853,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,3242295312306525868,15190972567239549809,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,3242295312306525868,15190972567239549809,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,17666983408773780084,2629767959745466503,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,4932082660129207046,4801385599870471394,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,13380657671515491119,6911037457330563197,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,7490575248744168825,6687153651754281109,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,18249058947527007482,11871314660336084461,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,16681299800238427394,17568760157555352580,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,889991804466054599,17653889159055440860,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,6715661323095152084,9944076930273795629,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1272,i,3684313100798177375,329297431880190892,262144 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,14595636472630866942,7555281506855237163,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,13067956101249904135,14338141982449308536,524288 --field-trial-handle=2636,i,18023880722041696852,5294674004153610638,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
    3⤵
    PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 90c51e74dc24acb07aac3576b8e42a2df56490734e577429ee5c66b7c6441830
MD5 8112a588d2fc6caf662ade1165dee3e5
SHA1 23494fcd5f91e5b0a6daacbe6af6d4d964f7b874
SHA512 e6583a0c145e0ccbf1542bb6d8fc3c1e303e7bb702dcf493fb676892efe72f2ca079091143acc44c87d2c7e29480036aff5409db0eec393a9521847c04104816
TLSH
T18D5180F203622AD2DB2955FAD0E2446ABAF5C4C8AD036F7458B05C34485AF87E8F3473
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596b62.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596b62.TMP
Size 3KB
SHA256 283395297324d146337e50679095791e6ebf0338ce056b734ee45c1f0e8ca581
MD5 9b0bb3a031fd3d48d0cea90eef4f13be
SHA1 9be556cf314a5b64894bcce11e3eddd8c3ff550a
SHA512 c8c27dc0956ed9120dbda42ad1e192919b4e91eb98fbf3dc56c68a43939df429485f681f53b3581dc351e05d3dff5174618dda5ba30e783372a27a6b7a134b11
TLSH
T1A35160F213222A92DB6955FAD0E2445ABAF5C4C9AD036F7458B05C34485AF87E8F3473
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7a803f4fb1357e34a64fddf1771259d3db0402fac3934fa8845a367e7a435a6c
MD5 1b802268b3d7691f2ab24334c330b9e2
SHA1 f3898b890cb906db47312ded86a00483077bcf43
SHA512 055013e9afc711c6d4e711b96fef8b8b43bfca4322a589123e17f4ea5a8db40e912ce70a3f9289d311a0f2f2c76ee49aad15116e47986531d4cdd07c724ce825
TLSH
T173419DF383F8856E8A1156F0AA146F1FCE2D0915432C7D9AC9E4EE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ec6e65e8ee0e7371a605f974bb5cee40676903d9e64e1b5301c3e56e1c12cd8b
MD5 e6af2bd30728a6fbf6b696276744e709
SHA1 3dcc009ee812ed3ac7bc8ddb1fdda7d4f3d5d122
SHA512 50d74cab7b7467a061cdd901ecf150c3184bc12fd35925a517e561522a53360b82d833f992a6584692ed6b2cbb916ade237f0b94c8b099064765df280574ebff
SSDEEP 192:sxRXRpCh/fks/qTlWZRVlRzoD8p4U/g6+WNIYGT0kJGtIgDqT9J:sxRXih/fks/wlgJ19/5I32IH
TLSH
T1B042C8156D64A93B9CCBE21CBB55BF53D6F96033A0902E54ABFC9A0C04EB6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 de568bd9e7c09cd3255f5dfc76c9813ca9f138faa540630a22fdf0d36742fa1d
MD5 9a96afb5ed4aa1f31986dfd6c7f51c4c
SHA1 309dc6dfab383fc743201b1e5e858179570b2f5a
SHA512 2c26936483eff069f35f247841db5c4152ff064918ef54cf26141585c2cc8e9e0921a2306557a3407d7c567ab7b6e724da19edb5450566f380909d9b4c4242a9
SSDEEP 192:sxRcRpCh/fks0qTRWZRVlRzoD8p4U/g6+WNIYGlbwkJGtIgVT9J:sxRcih/fks0wRgJ19/5I12VH
TLSH
T16532C9156D68A93B9CCBE21DBB557F53D6F96033A1902E54ABFC860C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dcc5f0783fbbb708c284fe4533c1a60389fc791937b6bdbf4027b3112d000626
MD5 73704050d8b9e17ddb87dcd787cb71bf
SHA1 f3dabcb79d4c91bc67d8571326bc00361f846560
SHA512 96b31ab48a90cc2c56576f7e3cf8e073ccc902863b4d454c874a228051a3335fc32a25945bfe860ce1d60f9d2ff2df45266a625eaa1fd5345fce6bb9078f0b21
SSDEEP 192:sxRXRpCh/fks/qTRWZRVlRzoD8p4U/g6+WNIYGlbwkJGtIgDIT9J:sxRXih/fks/wRgJ19/5I12CH
TLSH
T14142D9156D68A93B9CCBE21CBB55BF53D6F96033A0902E54ABFC960C04EB6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 043cccb2015062bd29c7a8e639a724d2e5b9b978014e19d1f4514ed8fe2b97b5
MD5 25b1566a37a3a3fcdb05b6f586ee5b8a
SHA1 accb086efe4d5dd2be3432804677105d31fb49d9
SHA512 832d04e4a900738a84c428291eb7d5f6eaea70f11094fe3d4ed56a32320b6151ecee2a14733e9555749497400e8e35595b99a8a6e5538b1d29bfadca6a661379
SSDEEP 768:UQYiJ37pLuL78NWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAG5pNKxroc:UQYiJxE78NWgv7fxJu1jafG5fKKc
TLSH
T19CD2DB7B740CCA7E4F804A9DAD197A9F6DA802CB96D8CD8047FE941C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6d2721810426c7456da567abb066ba8fb2303edbc20e24b763d70294885888a8
MD5 81dce3545442a3bfb0c3b113a840b29e
SHA1 b1584b924f62bfee275aab9f721099195dfb79d6
SHA512 35683ea05bbf95f2ecac29879dff6689668aa7558ecaffde3139231d70b9eb6d7c2067359ddc75b8339b700f07c2fd27e99226669671172d3c1df33a59aefe2b
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlkCHuC0UECWMZxgyCK4ngoCcSaBgCrXnqKYc2C:Cm7KmgIIJ4tWGm7g09OGlkCHuC0UE9ME
TLSH
T160916541767B02403C3EA91C85BC896BA6C27563301CA92B7FA865B60F76E025DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 140c60c99347da8aea7decf5dfe4c5afc9f050a5b49502d47233a2dc54aab60a
MD5 48b887cc1230679ed3a8943e30f5c5d3
SHA1 2b8e515d93066231a19e47eb32a2c7bcca262da1
SHA512 392afc1859e9f065b5e014aa15e59719ab1a1f3afbbbf0c4ba6cc29b8a96d545009093cb2f45521386e1ff4be24fd3b83bfd8dbb657baf4afaf8c9777658dcb7
SSDEEP 768:tT30lmlYy7/Wf37Hucys6BRvi82oP4/z6himo6BPi9P7:tT3/WW3imOz6ImoOPQ
TLSH
T17FF2BF30E8659D63ACBBD389A6453B936EF42233A4C85D94E9EDDB0D15C365E031BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 d8a4dc6ac7f9bc0f950cab4cfa6a3cde3fd41a9deecfb9d0aa6ef43086961e85
MD5 5272f82d4b90cb9db28549d11fbfecf9
SHA1 3834d03fa77a5986914c59f7383e85e6611f49bf
SHA512 88a8812159b61bee3df95b18a2c80a3a57554a6d336feb92e65ea7a72297d92c6995356ce92c8bdd914344402d3839c11098897b5680025ff566279272f2f41a
SSDEEP 768:Od30lmR8j//Wfd7Hucys6BRvi82oP4/z6himo6BPi9P7:Od3aW03imOz6ImoOPQ
TLSH
T140F2AF70E8559D63ECBBD3C9A64677836EF42233A4C81A94D9DDDB0D15C3A5E031B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 da369f27ab00a0ac512cd703ff6625e91dc35f7521f82d728e9a4975b506be39
MD5 d75b26594913ea388695258cc08ac640
SHA1 ce630bd0354b61b06e1eb91f3e75bd62dacee48a
SHA512 b24dc86536d9ea8f99a5def67e72b5f81e9cf80b0ba26ca8b797f69d1deae58c50e4594eed12f9e16b0201e78f86feac0c1056932d6f3126916950e30deb8933
SSDEEP 768:xGrv+4UNbdS3twOlYy7/WX7Hucys6BRvi82oP4/z6himo+C2bwn+h:xGbsbw3tpH3imOz6Imo90w+
TLSH
T14003CF36F4188D73ECB78288B50A7A537FF4522386C91A80D5DE6F0E128B95E131BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 1c9911e6a95ad4704646c40e876b6681b6d6accb29c207dc39ada88a8d7295f4
MD5 ec0ebc216daa94844131c8731f5e4ccd
SHA1 c76fd0870338bcf38fa392ecc6d4227f848955a5
SHA512 72095ddb091e910e6a6b74cb2bbb0341458b76a451ab723cfc9f1e0e65a0fec5016ef1705d0f6801e338a34479a59367c2f3c3599f0bbee244af73ead4428882
SSDEEP 768:Yrv+4UNbdw3m+mlYy7/WfY7Hucys6BRvi82oP4/z6himo6B2bwn+7:Ybsb+3AW93imOz6ImoO0wM
TLSH
T1A413BF31F419DD72ACAB9288B5467B933FF4226344C95D84E9DA9B4E0187A9E131FC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 42b76cefbe353a2cefa838f423d1b6014d8abf1e0c7289ff8fe49e86fff942d7
MD5 ee3fbc62f0022305ed310671a7a0634a
SHA1 a3dea3d591633c366d7a51d5aaaf94e211cfb012
SHA512 bfd83a98611023d0ee9d774777e062d894532e8b3cdc8b95c6916635b56391d45cdf20f29246dd4526a2bdf74ae5ee61d33d9d3aaf09841ea88b2821a6983dbf
SSDEEP 768:grv+4UNbdS3HYlYy7/WfM7Hucys6BRvi82oP4/z6himofB2bwn+h:gbsbw3IWp3imOz6Imo50w+
TLSH
T14803CF31E418DD73ECAB9288B546BB933FF4126344C95E90E9DA9B4E1187A5E131FC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

538c9fbe-285e-4c59-91e5-7c0653292fd9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\538c9fbe-285e-4c59-91e5-7c0653292fd9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3360_132728223\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download