1b97cd23aa694eeca9d8a622d802e12e9e8f1565c22e06f6ce7706ea35f11ccc

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
58s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 17:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ICE Free Temp.exe
Size 2.9MB
Sample260628-v6c19say2j
SHA256 1b97cd23aa694eeca9d8a622d802e12e9e8f1565c22e06f6ce7706ea35f11ccc
MD5 3e45963b04304015d9c49bea2fe5aedb
SHA1 1893ca88161463b72e4c80cbacbf8ace27975794
SHA512 3bb9129fc4f43f23ac5f7adbb8f5ecdf8173d8fa915446edf490adc9d4d341107b43713d2ce6735c47835b05e186c377294e11ae26f652a06719aff413d98b18
SSDEEP 24576:8rhQeGiC3xO79Eh84RnwhtHcrcXZbCn/AgV9zy8Ufm850UbHhEu1MumINH7ScU:8r6viC3kR4RYHcZn/AkNyNbHjbNH7HU
TLSH
T11FE55C42B3148161C863357CC3ABA61A7B78F04733E067D721EDBB08DD479AC86766E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hfQGDKAkFYdCWAriXbaXdc\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\hfQGDKAkFYdCWAriXbaXdc"	mp.exe

Executes dropped EXE 1 IoCs

pid	Process
1280	mp.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
41	discord.com
42	discord.com
44	discord.com
48	discord.com

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\IME\mp.exe	ICE Free Temp.exe
File created	C:\Windows\IME\drv.sys	ICE Free Temp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4276	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1280	mp.exe
1280	mp.exe
3012	ICE Free Temp.exe
3012	ICE Free Temp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3012	ICE Free Temp.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1280	mp.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	632	WMIC.exe
Token: SeSecurityPrivilege	632	WMIC.exe
Token: SeTakeOwnershipPrivilege	632	WMIC.exe
Token: SeLoadDriverPrivilege	632	WMIC.exe
Token: SeSystemProfilePrivilege	632	WMIC.exe
Token: SeSystemtimePrivilege	632	WMIC.exe
Token: SeProfSingleProcessPrivilege	632	WMIC.exe
Token: SeIncBasePriorityPrivilege	632	WMIC.exe
Token: SeCreatePagefilePrivilege	632	WMIC.exe
Token: SeBackupPrivilege	632	WMIC.exe
Token: SeRestorePrivilege	632	WMIC.exe
Token: SeShutdownPrivilege	632	WMIC.exe
Token: SeDebugPrivilege	632	WMIC.exe
Token: SeSystemEnvironmentPrivilege	632	WMIC.exe
Token: SeRemoteShutdownPrivilege	632	WMIC.exe
Token: SeUndockPrivilege	632	WMIC.exe
Token: SeManageVolumePrivilege	632	WMIC.exe
Token: 33	632	WMIC.exe
Token: 34	632	WMIC.exe
Token: 35	632	WMIC.exe
Token: 36	632	WMIC.exe
Token: SeIncreaseQuotaPrivilege	632	WMIC.exe
Token: SeSecurityPrivilege	632	WMIC.exe
Token: SeTakeOwnershipPrivilege	632	WMIC.exe
Token: SeLoadDriverPrivilege	632	WMIC.exe
Token: SeSystemProfilePrivilege	632	WMIC.exe
Token: SeSystemtimePrivilege	632	WMIC.exe
Token: SeProfSingleProcessPrivilege	632	WMIC.exe
Token: SeIncBasePriorityPrivilege	632	WMIC.exe
Token: SeCreatePagefilePrivilege	632	WMIC.exe
Token: SeBackupPrivilege	632	WMIC.exe
Token: SeRestorePrivilege	632	WMIC.exe
Token: SeShutdownPrivilege	632	WMIC.exe
Token: SeDebugPrivilege	632	WMIC.exe
Token: SeSystemEnvironmentPrivilege	632	WMIC.exe
Token: SeRemoteShutdownPrivilege	632	WMIC.exe
Token: SeUndockPrivilege	632	WMIC.exe
Token: SeManageVolumePrivilege	632	WMIC.exe
Token: 33	632	WMIC.exe
Token: 34	632	WMIC.exe
Token: 35	632	WMIC.exe
Token: 36	632	WMIC.exe
Token: SeLoadDriverPrivilege	1280	mp.exe
Token: SeDebugPrivilege	3012	ICE Free Temp.exe
Token: SeIncreaseQuotaPrivilege	2732	WMIC.exe
Token: SeSecurityPrivilege	2732	WMIC.exe
Token: SeTakeOwnershipPrivilege	2732	WMIC.exe
Token: SeLoadDriverPrivilege	2732	WMIC.exe
Token: SeSystemProfilePrivilege	2732	WMIC.exe
Token: SeSystemtimePrivilege	2732	WMIC.exe
Token: SeProfSingleProcessPrivilege	2732	WMIC.exe
Token: SeIncBasePriorityPrivilege	2732	WMIC.exe
Token: SeCreatePagefilePrivilege	2732	WMIC.exe
Token: SeBackupPrivilege	2732	WMIC.exe
Token: SeRestorePrivilege	2732	WMIC.exe
Token: SeShutdownPrivilege	2732	WMIC.exe
Token: SeDebugPrivilege	2732	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2732	WMIC.exe
Token: SeRemoteShutdownPrivilege	2732	WMIC.exe
Token: SeUndockPrivilege	2732	WMIC.exe
Token: SeManageVolumePrivilege	2732	WMIC.exe
Token: 33	2732	WMIC.exe
Token: 34	2732	WMIC.exe
Token: 35	2732	WMIC.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3012	ICE Free Temp.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 772	3012	ICE Free Temp.exe	88
PID 772 wrote to memory of 632	772	cmd.exe	90
PID 3012 wrote to memory of 1280	3012	ICE Free Temp.exe	93
PID 3012 wrote to memory of 4924	3012	ICE Free Temp.exe	95
PID 3012 wrote to memory of 4272	3012	ICE Free Temp.exe	97
PID 3012 wrote to memory of 1116	3012	ICE Free Temp.exe	99
PID 1116 wrote to memory of 2732	1116	cmd.exe	101
PID 3012 wrote to memory of 2808	3012	ICE Free Temp.exe	103
PID 2808 wrote to memory of 1680	2808	msedge.exe	104
PID 2808 wrote to memory of 4276	2808	msedge.exe	105
PID 2808 wrote to memory of 4356	2808	msedge.exe	106
PID 2808 wrote to memory of 4356	2808	msedge.exe	106
PID 2808 wrote to memory of 4356	2808	msedge.exe	106
PID 2808 wrote to memory of 3908	2808	msedge.exe	107
PID 2808 wrote to memory of 3908	2808	msedge.exe	107
PID 2808 wrote to memory of 2388	2808	msedge.exe	109
PID 2808 wrote to memory of 3932	2808	msedge.exe	110
PID 2808 wrote to memory of 2388	2808	msedge.exe	109
PID 2808 wrote to memory of 2388	2808	msedge.exe	109
PID 2808 wrote to memory of 3932	2808	msedge.exe	110
PID 2808 wrote to memory of 3932	2808	msedge.exe	110
PID 2808 wrote to memory of 3156	2808	msedge.exe	111
PID 2808 wrote to memory of 3156	2808	msedge.exe	111
PID 2808 wrote to memory of 3156	2808	msedge.exe	111
PID 2808 wrote to memory of 4332	2808	msedge.exe	112
PID 2808 wrote to memory of 4332	2808	msedge.exe	112
PID 2808 wrote to memory of 4332	2808	msedge.exe	112
PID 2808 wrote to memory of 4192	2808	msedge.exe	116
PID 2808 wrote to memory of 4192	2808	msedge.exe	116
PID 2808 wrote to memory of 3016	2808	msedge.exe	117
PID 2808 wrote to memory of 3016	2808	msedge.exe	117
PID 2808 wrote to memory of 3016	2808	msedge.exe	117
PID 2808 wrote to memory of 5092	2808	msedge.exe	119
PID 2808 wrote to memory of 5092	2808	msedge.exe	119
PID 2808 wrote to memory of 472	2808	msedge.exe	120
PID 2808 wrote to memory of 472	2808	msedge.exe	120
PID 2808 wrote to memory of 4656	2808	msedge.exe	121
PID 2808 wrote to memory of 4656	2808	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\ICE Free Temp.exe
"C:\Users\Admin\AppData\Local\Temp\ICE Free Temp.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic csproduct get uuid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:632
- C:\Windows\IME\mp.exe
  C:\Windows\IME\mp.exe C:\Windows\IME\drv.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1280
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del C:\Windows\IME\mp.exe
  2⤵
  PID:4924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del C:\Windows\IME\drv.sys
  2⤵
  PID:4272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic csproduct get uuid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/dTwE4GRVdn
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffbd0cec188,0x7ffbd0cec194,0x7ffbd0cec1a0
    3⤵
    PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,3462679876639372219,15029284084867711200,524288 --field-trial-handle=2360,i,5333991841705677101,1688755722144347903,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,17494029597413053188,14569956513201890876,262144 --field-trial-handle=2360,i,5333991841705677101,1688755722144347903,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,13342632867192453134,14712639526304546121,524288 --field-trial-handle=2360,i,5333991841705677101,1688755722144347903,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
    3⤵
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,14088097974314175936,10601918190659055365,2097152 --field-trial-handle=2360,i,5333991841705677101,1688755722144347903,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,4187451253286273942,5672295107441667344,2097152 --field-trial-handle=2360,i,5333991841705677101,1688755722144347903,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,346451723734916018,11031143282270244707,2097152 --field-trial-handle=2360,i,5333991841705677101,1688755722144347903,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,2226487496635396936,812815511197998973,2097152 --field-trial-handle=2360,i,5333991841705677101,1688755722144347903,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,14011867427790305640,3591297751839123428,524288 --field-trial-handle=2360,i,5333991841705677101,1688755722144347903,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5228,i,7717004315534072408,7363098089937330388,2097152 --field-trial-handle=2360,i,5333991841705677101,1688755722144347903,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,11279846251482200937,6711923983859865881,524288 --field-trial-handle=2360,i,5333991841705677101,1688755722144347903,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,9698583631796628957,16843962160632379257,524288 --field-trial-handle=2360,i,5333991841705677101,1688755722144347903,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
    3⤵
    PID:472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,1512016834012184442,11892607480970158658,524288 --field-trial-handle=2360,i,5333991841705677101,1688755722144347903,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d558a7dbb07258035a28ebb96155d3088ba12070a905d96a192219fd652a5b0f
MD5 38c8616efcff6ac6932a3f720e492452
SHA1 30b9c534337743f5348421c59c51a1c748b57539
SHA512 bcded830870ab8ad135070deee1a72a369ea62cc2a21ac32ae640146e03327b95b43402e6f862d575a77a77c4299308c592a87df2d9e94548c79d843cb710f52
TLSH
T1DCD080207B3974C1D21A0075E5124B40169D45F72597430A7614440DAD794C6E6DFAC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0c426b7bf2bb3c5389a3a9c005657d716d6b96430a0f834a7858107e97dcd117
MD5 0ec48a7be7e575b172abfb6377222f3a
SHA1 ba7c063ef09d07168f1480cc2186880a75f5aab5
SHA512 7a7412130d3678a52bee868ea181839811f913574fa0801801b878eb3dfb24a4ea2f1c11b976e843c5cca402d1886c4392c9e760631f81261b16e263c541a715
TLSH
T16881CEF4017A489EF799DCB270F241023672B9F9FC9F2D4680D09A3475E2314991B27D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a1d9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a1d9.TMP
Size 3KB
SHA256 c1dffccd9226abd21cc4029c8f4108a3be6634219224c6c1c0715f0aef1f4e1d
MD5 ab7e4b47a894369ff81182c796c339c4
SHA1 d146ec5be9980991cb39256c5a875a47f958a3ee
SHA512 bf40774df8ff9f4787741087cde499e4ca8f155af7928e7b31327d4e7122d227c9d823986890e9d9c63a165ceea37c2be679bd521d40e5ce9a31e6fb303c2b56
TLSH
T18271B6F54279489DFB6ADCB070F181023531B9F9FCAF2E9680D0EA387A92354990B13C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 72219a1351f6d20a1c7ae8bb59e556ec73d2fc4654ceca25ac7e6b7e933923b9
MD5 67fa24e6a86c66ad39a0ee813fc06e68
SHA1 f0888b80060775be2f64e0b3d426c2160f2ce5fa
SHA512 2699ff6057042b12c4b945c08c22e26c614e43f4bec16a9b100b24a5da40b5e0198d42c88633fd7b5329e4625d53627e830530d331c24f0c8116addf241e0fd2
TLSH
T1412167B7C3E8896D8A0146F4AA15AE2FCE280914432C3C2AC8E4AE1F93A2565E14095F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d611df907e8e47faa1cd352a2bc2f506457b01220d52ebeaf9e0e4c9592b9d13
MD5 4391d34fc2adb1424dde603b9c7ad374
SHA1 147bcf43cdf82d2c06d517f4fe0e82f20e3193f4
SHA512 b47f8a40fec12e2202658ebe226dd259db8257931ff8a416aca5796ada58eb467fad0dceb8ccaec10c43b0998ea95cefd23b19ca9561242b9f2bc24cc7a0f55f
SSDEEP 192:sxZERjyM/jK1Ml87jK/fVsXWpVno9/EdpEIHW6+WNuP4f/YTk47ZIgEJ:sxZEP6K/fVsXWvnou1HbB/EI
TLSH
T1BC52D712AE34597BCDDBD209FA517F53D6F90463A2910E44AAFCCA1C01E7AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2b852999fab19d4d11d8a78dc6ad852e7d2885155ad04b35952dfad2a051a62c
MD5 d2a89a079e1ddd699594f23af92d404e
SHA1 9057b040a142a4cadf7083fa1267cc42e18134a0
SHA512 ac6db8f1c1d9a8bf25ce4c53a6b063ebc04f68958967147754c9d7f0e5538167bc6a32dc47779aea91f117e2773235ea68259b3826d734b29abb0368232315ac
SSDEEP 768:DOW7k+0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OV45LlWYSjBroIQRDY3:DOW7k+0Wvqidau1jar5LA3j6M3
TLSH
T1EBE2FA3B680CCB7E4F841E5CEC266F966ED801CB6698895487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 d1511e0615a422cd3e0691b1e0f89a1372958c8fc3432b1d69a24c1f46f08e79
MD5 b6f5a236c0ec466988e260add981293d
SHA1 0ba62a22f671c247620b56dd93d02649189fd2b0
SHA512 92e8672ee08405b906bd1ea6e6bfb90b054172549741e72dfa27aad6251dde42447464fba1be3877b597701100c460a2e9d48fffe3f2ce0ea53209dc9f8263bc
SSDEEP 384:zVsNY9JbWvntdKR+29sqIA8tkklitOK+Y4Mkep:xbUtwle48G8K+Y4Mkep
TLSH
T1618229B0D8A65DEB4495E4C9A642F6136DB8113B8A8C5A0CE7F8F73C319F5F82707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5122acea173c774ad126f85214c772cc1340640d83f5783f65dc741bbaa67fe1
MD5 97027b8a80d527999cdbed3f786b3e2a
SHA1 1569e3486261204074933c2ff0446d46ba7a891e
SHA512 f51e54b68ded68e733e96143557c720eb3774e7e2eadc3f2277be1a76bdf41f0c94aa245885148caa5d3b0f3f68ffc8c5e5f97be2bd67d71709213a227fed7ce
SSDEEP 192:MONG64BAQmiUyT19W5GBPKp/+FdG7BvaDJCdU6:MONG6eAY3WOdKCEdU6
TLSH
T1D602EB35AC786C7B9FA2AE45F5863B175FD8113BA6D52B44E6E85B0C019764C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 69ad4dd7edbd131728563c3c423c62f6075b8b322334dc8b7edc3d53c36d79a2
MD5 7021841d01bfbc80f04cbbb0c35c11a0
SHA1 164c4e5011b535d3674ca732f8b08d677b3895bf
SHA512 919d0db3b0d226ce7afdbcd340964fbf028e25571a92372244c0bae7dd569a689f8699a62954176e19294d04809631d4ce2911b1bcbe8e0f7cb1623c841a5eb9
SSDEEP 192:vONp64B3QmiUyk9C5GBPKp/+FdG7BGc+29mWwrqv+U6:vONp6eZvCOdKR+29EpU6
TLSH
T191120834AC699C2B5A92B505F4C737536EE8117BAEC5AF44F6E89B0C01D778C370B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

792644b6-e49f-41fd-98db-0165e2cae2d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\792644b6-e49f-41fd-98db-0165e2cae2d3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7d0d0e94e1861e23db813524e96b4c0b7ca8dd2c732ca88b33010ec14ee0a2c2
MD5 f366610986f5bd5b842d3b115d4bf687
SHA1 59aa66ff75cdaceac444b4f59543af61e0ffa7ec
SHA512 6803f78e181bb34b496d97d1867b1e1e0aae19273bfada7bbb5d071617301e2d706ed2d1b8a037c4c81fb8243785fdbe4c3ef9573dd157cd218be16d1fdf1617
TLSH
T1E241F858A6F90148B3B76F199BF6A8AD487F7D772E07D46D00110D4F0A62B40C972777
MD5 SHA1 SHA512 TLSH

Submit Download

drv.sys

Path C:\Windows\IME\drv.sys
Size 54KB
SHA256 8dae356d5c20808d893d01582e37860a6eb775df0c3bc6bc66c638ca1ecf0733
MD5 de00b923d5716cd646dc15ae1019b94e
SHA1 4798d7d352dea7024235a0c72ca0c867799065e6
SHA512 696d99b942067c82cca7a1a19cf21e1434834b827d0459cd779ed8a3c3c03aa94923443a1559cc40253b16e3c64729b0e66bc315ca0a1f972debe33094fe7863
SSDEEP 768:1ki6giTKmEpIVrc341kOygzy4rj/5X0uJ+9BrtzL1omsFRZCxqJg5MqqapZN:uemXCEkom+j2u8btprJQmZN
TLSH
T170435B52E39566FAD26682B8C56B5417E7B1384017365BCF0BF18C992F5BBE0F03A342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mp.exe

Path C:\Windows\IME\mp.exe
Size 143KB
SHA256 d741bbe967629354fed9ed6d6092c3a3f292b337a3ca5dc691e936716b67d78f
MD5 4360603cc8435f00021e7eab639792bb
SHA1 a0784ac509a513bc6a17903d2bce7b787673eae0
SHA512 db7d61b916e552b9954a86ae30d6b92926a7d2b57b30e912925d3c80453d181d6514cb4fa31e66f9b75b12eea332de5bfb8df5c8b094f6ac46ce06ab46e436c0
SSDEEP 1536:GLpaS4J1iD1vZO3DeZL+3AI1+bslVZ9D6TXMhPtYPbjABuM0z/:G71cCh+3ADbslVZ9DQMUPfAE
TLSH
T1CCE33A1AA7A61069E2B7D978DDA20501EBB27C554B75D7CF134088B90F327D0BF3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download