0c5699b8412c30f5f1b7279cdee8ed72c5a77bc6ed85799e938c3878d60c6159

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aruba-enterprise-logo.svg
Size 16KB
Sample260626-phnvzabt2s
SHA256 0c5699b8412c30f5f1b7279cdee8ed72c5a77bc6ed85799e938c3878d60c6159
MD5 bbb80968467e1a6084c61e8846fe5c8b
SHA1 9e31602d7e3027f4c2b943b85485d680af631221
SHA512 bd91d78d21d57d834f5c2e015ed1462be541bb5dd31982dbc0041c0c46215a0192001c38c8c35fa28ebcf11e858af98d1e89bd0110d709bb6765a922c2207497
SSDEEP 192:vgfrsQ+EVBk5d6TXG5cBo/JInLhpbZYtsBiJx6ZuVxYUXi8U4zT4ArZPFrWipOtF:vgwvED2CDIJ0pbZf5soUXiy50ioDEy
TLSH
T1B372A6771390ABFDA6C14B448A64609E37F6A4A6B1F9D2ECCF679A51DC05AF30038C31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1793693123\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_931824195\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_931824195\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1793693123\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Sigma\LICENSE	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Mu\Cryptomining	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
852	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269500052225976"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4274393721-1801116158-3678143273-1000\{B0B8F4B2-AA04-4917-B042-813F44D85435}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5956	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 6052 wrote to memory of 5956	6052	iexplore.exe	90
PID 5956 wrote to memory of 700	5956	msedge.exe	91
PID 5956 wrote to memory of 3944	5956	msedge.exe	92
PID 5956 wrote to memory of 852	5956	msedge.exe	93
PID 5956 wrote to memory of 3944	5956	msedge.exe	92
PID 5956 wrote to memory of 3944	5956	msedge.exe	92
PID 5956 wrote to memory of 4472	5956	msedge.exe	94
PID 5956 wrote to memory of 4472	5956	msedge.exe	94
PID 5956 wrote to memory of 6464	5956	msedge.exe	96
PID 5956 wrote to memory of 6464	5956	msedge.exe	96
PID 5956 wrote to memory of 6464	5956	msedge.exe	96
PID 5956 wrote to memory of 1392	5956	msedge.exe	97
PID 5956 wrote to memory of 1392	5956	msedge.exe	97
PID 5956 wrote to memory of 1392	5956	msedge.exe	97
PID 5956 wrote to memory of 5460	5956	msedge.exe	98
PID 5956 wrote to memory of 5460	5956	msedge.exe	98
PID 5956 wrote to memory of 4776	5956	msedge.exe	99
PID 5956 wrote to memory of 4776	5956	msedge.exe	99
PID 5956 wrote to memory of 824	5956	msedge.exe	101
PID 5956 wrote to memory of 2204	5956	msedge.exe	105
PID 5956 wrote to memory of 4540	5956	msedge.exe	106
PID 5956 wrote to memory of 1036	5956	msedge.exe	107
PID 5956 wrote to memory of 6180	5956	msedge.exe	108
PID 5956 wrote to memory of 6180	5956	msedge.exe	108
PID 5956 wrote to memory of 4192	5956	msedge.exe	111
PID 5956 wrote to memory of 4192	5956	msedge.exe	111
PID 5956 wrote to memory of 6208	5956	msedge.exe	112
PID 5956 wrote to memory of 6208	5956	msedge.exe	112
PID 5956 wrote to memory of 2716	5956	msedge.exe	113
PID 5956 wrote to memory of 2472	5956	msedge.exe	114
PID 5956 wrote to memory of 2472	5956	msedge.exe	114

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aruba-enterprise-logo.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/aruba-enterprise-logo.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc03c6c188,0x7ffc03c6c194,0x7ffc03c6c1a0
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,4583094548632891342,6657290841772905075,262144 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
    3⤵
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,16647542844276726581,14683027143107825270,524288 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
    3⤵
    - System Time Discovery
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,2504912538338728456,14312430555559145818,524288 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:13
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,15586018590680576904,3025800742336349785,2097152 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:6464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,2181700345365623416,8546264551345724316,2097152 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,7311076563889184308,18344381612641270659,524288 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,6137411808519737884,16212200400088811166,524288 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,2479444208609337415,14196996945809886100,524288 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
    3⤵
    PID:6740
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,2479444208609337415,14196996945809886100,524288 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,2368614100938666303,6880287904789443326,524288 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,845692488776909294,12712772886660677424,524288 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,9657693044258983985,4578632950080329653,524288 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,15946000871065320346,5039998676720555145,524288 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:6180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,4022283069093888191,10844565190235659471,524288 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,11456516388095165584,5235187743487785972,524288 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:6208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5752,i,8576576359309385114,15421423678425442794,262144 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,9874485837686756068,7832119703904071634,524288 --field-trial-handle=2336,i,3165700642709083221,1258951586574178457,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 afab44831d15737b93a51b5da32d6f7ffdeb215ed2ae065fce98d07ea4026ae9
MD5 577602fc13804460f1a4c682a14371fa
SHA1 75c72bc7e167208774b7c3c199ee72158d472d5b
SHA512 cf269890ba0a2bcf1c40983f5ab82ca0bed90f59b35f5275ced490c8da7884427c1e64cec45fcf6fb345409604822a89ee8e179211bc96abdb7d379a2baa2ee4
TLSH
T112D08021350EB882D11B10FACD62C316711985636263D10E7991D02DCC974D0B3C5597
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a61df6b1b5973a8f8515610c489bd12e6e001f8527beb5b138216e21393998d2
MD5 1413e4dcb4a722f7a2c851bea622b10b
SHA1 a394fd253f2f3468ec63381b79a7be8f141d441f
SHA512 78510b7b5833d69d44a1969dccddd809ed47ba6d93baa551566bbbb962c07880ca89cc801765cdff99b247b04e98234ccb9c522675e88277eebfffcde1a48baa
TLSH
T1BBD08021350EB882D51B10FACD72C326711985676663D10E7591402DCCD74D063C5597
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e0241a7308ff27a4853bcf7e72f6e6e9f231c0a84e409d7626452da09ad347e1
MD5 e23620e82f1eaaef1756c078e0e7da64
SHA1 3fec074a52b8355e03e042c81a115da5488baba4
SHA512 d6bfd8f23638d93532b04e88eb54e4313f49180dda64603d3f53946d150afa6acf9ff5389a8e30c0b94db70646ade1c72137245c2f41f5d5c275088b13e688a9
TLSH
T118F0A9A9C932EC3B18FD0B1971A44B4BE751132B6741995B3B7C820C4FB167B464AD1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 072eb91da35c8b5a9c41144e2f6ed6c8fd55f1fcf1c4a2ddccc59d7e71b0f55f
MD5 ae3c5f47445f73f902b0f010da38f2fa
SHA1 c9d2672b9844836a865da2700132f5815182c280
SHA512 bbfa2b83533f25bf293846099a31d981f98286b8de1ff7d272c00db6e8d1b079ea8176afe03a60aa49e8c4931edb617beaa74560173d705b006fd1f65825d91f
TLSH
T1CF41ACF3C3E8866DCA1156F0BB187E2BDE2D0914832C3D5AC9E4EF5B93E2471E14194A
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 fcaf0c697cba2c8693b9a149402c051f0288cef6c66a6c6e1c0b58040166ec35
MD5 8e72e529634eb19c8bde67b1dfcda9e2
SHA1 93af23e84dfed2e9161827f6dde46de516b2dfd7
SHA512 382182ce047e53692825279c23507db1af5a671e5e1250469b0ae3b641407063151784ec1cd3e4a4579b78b63cc13134c5c59c7a31b35b5adbbb1d15db1358c0
SSDEEP 192:sxR+2RwyMqZjK1Ml8UQPcX/fBsqggeWsZuApqmAzoA8pey/g6+WNIYJDvDvGFG+T:sxRx5qEX/fBswPSPqER/5I0vGZHz
TLSH
T12F72E9165938897B8CDBD619FA957F53D2F81163E1945E44AAFC8B0C00EBADD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 aaf44ff2835df12324a814f008caf026fe9373202c300d79d02b8642a7cac9cc
MD5 14405f780831fbf40eff86279899bc4a
SHA1 3800efe7f76edfc6598de8f8e6cee0c82eee40ac
SHA512 9848f6ec07e3972fadf16c9e111848466fbc747cd234417437aa1425096ee10702a1da660af48e9cbc34ef49a56e665ed647492f3d1b25367d3d5bae2c00f30b
SSDEEP 192:sxR+2RwyMqZjK1Ml8wcX/fBsYgxWsZuApqmAzoA8pey/g6+WNIYJDAqDvGFG+Igf:sxRx5CX/fBstYSPqER/5I0vGZjD
TLSH
T1FD72EA166538897B8CDBD619FA957F53D6F81163E1944E44AAFC8B0C00EBADD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d58b1a987269760611704a54b8c591133c924dd2d5c35cda763da436e59d82c9
MD5 3a37fa3b52414994ab37f7a69a2adc62
SHA1 c0746c292ea09501f8493d3d4359af9673c28c99
SHA512 b7e69e6cc7a8943eee3e90353e28a663dea11011bc89096285fe2a767b35e0351f3056b2aa97fc9a6c2cf6f2a3be6238666694121e5383c931944fe8f0352c5f
SSDEEP 768:AeaxFJ7pLuL7n6WgGMffA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVErxu8CcrofF3QG:AeaxFfE7n6WgGMffAu1jabrxBCHd3QG
TLSH
T1EBE2DA3B680CCB7F4F844A9CEC29BD9E6DE801CF9698CD9447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b621d3fc9154e357b80fe7384e460d4077d373e37435fa09a4c512ee60bd0b6e
MD5 90da4c516fc73519aad50ffe9099eac7
SHA1 1902d9fd8552c6265233fd45ea15a6bc9e528ae3
SHA512 90c0a51d6190debdb0cf3435d7325376fe166b2f4c1b10549b8a702ea46eb67bc6a9ce280bba8a550dba0105315734308eebcccc6990163280818b5dc12f41c1
SSDEEP 384:CEsqH8wSgMr85QoaiVuNqCBUsDJO9ZfLHob0Vx1pVnopZUP2PHbAzvHvR0HMX7:CE9RKPHbAzvHvR0HMX7
TLSH
T189B239517A7E224139BE2918D194966F674270B3301EA53F3BBD24E21EA7E000FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de1b6a5f-e2c2-463f-b815-4495b5313161.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\de1b6a5f-e2c2-463f-b815-4495b5313161.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d700112b5ecdf850bef2108c6ec72e6d1632c7cb3889dc43fba0775d258a4489
MD5 b821db8b12a04a0275862f5312c45d70
SHA1 96b070856bacd2d9d929a0bb5011b1e5dba5365b
SHA512 4d4e87204f738404f0a905eaba62f434867eeb006d050108ebd13ea2295b1dcfee79ac063c10b3a68c150bd60257acc4b124b2714c58c822e21bd60ecab30334
SSDEEP 384:nNiF1tNn/s3n9SQ8NB8TUNTUlIRH/F3PdT/c2HfoBVeev4H7syfETTmn15wbAjEs:EF1j+9BkwgBdd16Veegbxf+Tmn12bfs
TLSH
T1D8D24A32D8A4CE77ACE79ECAB74A768AEEE001A385CC59D4D9D84E4C00D76DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bbb3c226272777e81237af8fc513f678f7a1578493508bb9baa064131b160138
MD5 59009cd169a0beb426a83e50fb45ab68
SHA1 545613bb2d557f823bbfb0186fd8ac5bed32cb95
SHA512 e6d949336a34f8756e2416c04b2772c8997daeaa65bc55d2a8212f227de3e3ea4c30c8b85e50d4ac5c6359c0abf15a63c247a4c3ac06abd1aa24be33489233c0
SSDEEP 384:nBiF1tNn/s3n9SN8N18TUNTUlIRG/F3fGoAc2HfoBVeev4H7sEvITGT0IRun8Lk4:oF1j+9AYwgKZj06Veegb1vi+09rv2
TLSH
T1BAC22936D864DA7BDDFA5FCAB74A764AAEF0016784C86AC4DADC1D4C00876DD0347C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7a62112af58c6bcb3136a6bece96da5cc3f2e4a223824a9e55acf5890376520b
MD5 a18a6263025db379d1d5b94031a13fcd
SHA1 864124e060ebedb0bed8af12d608a4bce9f88afe
SHA512 98edd635ba9dcb69ad6a51ee0f042b54a23801d046bf8eb97da7fe75692b97a389747c97bdab53d9a9253df5f913a0c506ad3142c0d35918f3db4e8353d8d724
SSDEEP 384:nLiF1tNn/s3n9SB8NB8TUNTUlIRH/F3PdT/c2HfoBVeev4H7syfENTmn15wbAjEs:mF1j+9wkwgBdd16VeegbxfKTmn12bfs
TLSH
T1C8C24A32D864CE77ACE79EC9B74A768AEEE001A385CC59D8D9D84E4C00D72DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9cccef68b7bd4ec44989eccb485edc422cf27e16f54d77a04e4b4125d5c9a3d8
MD5 d7208ddcbbeeb6b14a1bdd6929f5f79d
SHA1 6f1ea641be9c51f0645f67096833068b9389fc22
SHA512 5b1a5487ce7bfee7878f08f5c79913812baa9b172275b6282aa206f064d41adad7b8807a61a14a5d2c227d0414600d1f5c5249844b1cf058236cf11301354e7e
SSDEEP 768:VF1j+9wkwgBdA16VeegbxfhTmn12bf4vd:89w3eglfV0y4vd
TLSH
T172C24A32D864CE77ACE79AC9B74A768AEEE001A3C4CC6AD8D9D84D4C00D72DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9288c58957bd8b486fe4e1851fa82a8b09f8abbdcb9f41e653fe9dc92e98c6bb
MD5 44ca745ecf50e3dc48671f38e9050957
SHA1 bf40990d88d454e45c5f1df8e8db7a57e0d45905
SHA512 59cee3a04f305ac9af6909c907eb785be9822c1e4f95430d02a3263ab8ecfc1b56d0eeae4d0177fb1a695856abcd13f13a1f9b4de468f48e5d6ea4b74c0b2fb8
TLSH
T1682112E16C291AC5C8BE0DEF749739FC54E8E325F5A430782C94EDA41A3D61D264087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7b135cdd462f2ad4f48f3156f3bf5a912f910e9ed32025559a13b57cbc83dd60
MD5 ea7342884fe6f5aa341b8f35726ecfd0
SHA1 a658a45d0af71985493f4da41dad9f9df06d66b2
SHA512 82e5ff64a79cd523ebea7e37bab2817a5f6542770a7266ece5975ea61e7232d7bc5adcc6a3b06ef7592a34070dfd66b50382a0b7221816e24e511671b516d2d9
TLSH
T11C3141E06D292EC5C8BD0DEF74D738FC94E8D325F5A434782884E8A41A3D61D268087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7dddfe95c6ed1117014438b2ce4d9b31694913bb48191746efa137b3772e1607
MD5 d7df125aba88faabf0c21fb57bddd0a4
SHA1 b1c48b5f7defa261662e52a1192e34438abe8cf6
SHA512 6b353309c1b08a350501d9a46910b0ee09e388ff6c09f8633a7b6a123853eb7febcf5cc598f048e6861b56c6434ac9c020e71d6a822875613bd7a709af27cdc6
TLSH
T13021FEE16C291AC1C8BE0DEFB49B39FC54E8D326F59030782894ED94162D62D268087F
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_362484898\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download