6bd8880193131672d32517ed1ea30cf871f317b9a62f523f67b8a3b34caf1722

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
30bg/images/adobe_logo_black.svg
Size 2KB
Sample260705-alrnpsft5v
SHA256 6bd8880193131672d32517ed1ea30cf871f317b9a62f523f67b8a3b34caf1722
MD5 e36799e0084267aa804e9b470de17094
SHA1 c15770f1faade2a58003ba8d3e34940621987de2
SHA512 c3df0bd86d66a78dc46161d0e5b10802d6e9c34102e8743ea600f995d1018f30b314275d6be9195937aa24f62fb452d2fa5c61916e72a81cd902808464bc72eb
TLSH
T19E413277E22D9A7CD0800388C287669973AA94D7769382DCB31F68C64F178F3C5B4654
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_2119760618\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_2073570999\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4924_2073570999\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4440	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276843170408516"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{95C8319B-6F3B-4470-AA0A-D17CBE87C023}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4924	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 4924	2564	iexplore.exe	88
PID 4924 wrote to memory of 1312	4924	msedge.exe	89
PID 4924 wrote to memory of 4440	4924	msedge.exe	90
PID 4924 wrote to memory of 4228	4924	msedge.exe	92
PID 4924 wrote to memory of 4228	4924	msedge.exe	92
PID 4924 wrote to memory of 4756	4924	msedge.exe	91
PID 4924 wrote to memory of 4756	4924	msedge.exe	91
PID 4924 wrote to memory of 4756	4924	msedge.exe	91
PID 4924 wrote to memory of 1720	4924	msedge.exe	93
PID 4924 wrote to memory of 3396	4924	msedge.exe	94
PID 4924 wrote to memory of 1720	4924	msedge.exe	93
PID 4924 wrote to memory of 1720	4924	msedge.exe	93
PID 4924 wrote to memory of 3396	4924	msedge.exe	94
PID 4924 wrote to memory of 3396	4924	msedge.exe	94
PID 4924 wrote to memory of 5804	4924	msedge.exe	96
PID 4924 wrote to memory of 5804	4924	msedge.exe	96
PID 4924 wrote to memory of 5804	4924	msedge.exe	96
PID 4924 wrote to memory of 1872	4924	msedge.exe	97
PID 4924 wrote to memory of 1872	4924	msedge.exe	97
PID 4924 wrote to memory of 1872	4924	msedge.exe	97
PID 4924 wrote to memory of 4120	4924	msedge.exe	98
PID 4924 wrote to memory of 4120	4924	msedge.exe	98
PID 4924 wrote to memory of 1076	4924	msedge.exe	100
PID 4924 wrote to memory of 2628	4924	msedge.exe	101
PID 4924 wrote to memory of 1076	4924	msedge.exe	100
PID 4924 wrote to memory of 2628	4924	msedge.exe	101
PID 4924 wrote to memory of 4132	4924	msedge.exe	103
PID 4924 wrote to memory of 2192	4924	msedge.exe	104
PID 4924 wrote to memory of 2192	4924	msedge.exe	104
PID 4924 wrote to memory of 1664	4924	msedge.exe	105
PID 4924 wrote to memory of 1664	4924	msedge.exe	105
PID 4924 wrote to memory of 1296	4924	msedge.exe	109
PID 4924 wrote to memory of 3896	4924	msedge.exe	110
PID 4924 wrote to memory of 5720	4924	msedge.exe	111
PID 4924 wrote to memory of 5796	4924	msedge.exe	112
PID 4924 wrote to memory of 5796	4924	msedge.exe	112
PID 4924 wrote to memory of 976	4924	msedge.exe	116
PID 4924 wrote to memory of 976	4924	msedge.exe	116
PID 4924 wrote to memory of 4592	4924	msedge.exe	117
PID 4924 wrote to memory of 1056	4924	msedge.exe	118
PID 4924 wrote to memory of 1056	4924	msedge.exe	118

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30bg\images\adobe_logo_black.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/30bg/images/adobe_logo_black.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7ff844e2c188,0x7ff844e2c194,0x7ff844e2c1a0
    3⤵
    PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,10402518202343248664,14345216031125118649,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,168793626376631958,9065919728879406589,262144 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,4742153283661763597,16943690989268505927,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:13
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,18305899663798591627,12793174477055537490,2097152 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,6265753038430416702,8660184795726345800,2097152 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,5378315046493094065,6150883984422343356,2097152 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,17446017051062863207,3767558109862864821,2097152 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:9
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,16535301196969725777,484996458400939697,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,8523919178812166368,4189514383762986652,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,630772814337297628,14294538477167940812,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,18383392586969551640,15626406123500357776,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,18383392586969551640,15626406123500357776,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,16907336837939100657,4345213367066629089,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,13711102252569176045,6165774180791553701,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,826894438554140206,4927328452084705869,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
    3⤵
    PID:1296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,5073253852246605802,17848718375049791286,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,15804410920895098705,2036350654535358721,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,943566199786268353,15351157642383443218,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,12144499982347372793,13498194176641624695,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14
    3⤵
    PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6584,i,15365926570946132668,12902464988354333514,262144 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,10550680098027124619,12194102928654949026,524288 --field-trial-handle=2020,i,12890290093688007907,9505219745765898467,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
    3⤵
    PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b06663b3192571f2ef91fdc212fb31410c55f64a32ebb6b30f52340a47dc2bbf
MD5 b5378fa61b4e7ed3fc358796ea3de641
SHA1 7455e728e11aad790daf465406a19151b276e2e4
SHA512 5d21522b58c786159dfba5d68de1fae1a7bcd8aba80dc1bb95100fa727836b83e747856c89121d95c6acb45907ded02ac6c00ac4583a07c65fe233ed4bff1ce8
TLSH
T1AE6150DB18630AA5CB3605B537ED14B6B3B6D86E79076E33109CB0757DEA3D6E842430
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d90bf89c9fea1aae917afaca10cf92585473cc01039c8153ac8d0537bf01ed8a
MD5 30b811f064c89fd7c8623e892b48c9a5
SHA1 61114c20ea24971c7cea35f53980ec18553a5c12
SHA512 b1cdf20a36a5778c9d83e8c82b46e02735bf57ecc0fa767123ac91e458c7f218380faeac97bda48c2dbd53501001a2d25c14313197907c7e7de40e5711c56ff7
TLSH
T197519DF7C3E8866D8A1196F0BB186E2BCE1D0914832C7D5A89E4AF1B93E2472D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 13b24eb8d21e5cf4c581ac6d0214b1446147b068e7a057d1b821347c289d509a
MD5 b44cf50c26d6c45859f78501d47835a7
SHA1 d55e8cc4c6d588e73b4aed555127aa4f69321595
SHA512 3a127b1afc3222b8a38a697ed83e94a5b62d4ec37ddec546dd02f40f2149b4bdac556adb11d15025e57f6136c6a85b5c11ceefbced90e134f90290d88badf44b
SSDEEP 192:sxRRRyyM/jK1Ml8UQTc//fNs001hwZPqtxGzoA8peJS/g6+WNIYyeJr+GSIgDOJ:sxRREq4//fNs0SuP+dL/5IGrYe
TLSH
T16862D916AA2899778CCBD609FA417F53D6F95573E2900E44AAFCCB1C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 18205e37a9e36bf41ae65a760ccf7b5d02851abbd9e1537c8880d10b4e243342
MD5 07bd8ebcd304b448f7cb9561b9842b67
SHA1 07d797deab449cfd9d7d58de2b36e18a8506e4d5
SHA512 6f9d3274564955344b6f967ad2c81188c8cd524e51182196b5a78227d3079e624d95332a39c7e172eac084a3246a15134f7258d7bcf44cc1bc9de64e6e929622
SSDEEP 192:sxRyRyyM/jK1Ml8wc//fNse019wZPqtxGzoA8p4JS/g6+WNIYyNJr+GSIgtJ:sxRyEC//fNseSuP+d9/5IZrY3
TLSH
T11052DA15AA3899378CCBD209FA517F53D6F95573E2900E44AAFCCA1C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ac75c4263b5ba234909d8d68d18b7216ccf13a241c1e1e6f9c892277c1f36bec
MD5 48caab8bf1e59704a4dce11e56448b0f
SHA1 9f80ab3c2fbeac84fdcce92d829865b088b0de92
SHA512 de9e82c3dc482d0c70883985f060aec54d43e59cd7589273cafe0c461a338e2ac3582e89fbbf57803f2fa11d6f413ff9e6079e0e4d788a58dc48f5fb9d1d7651
SSDEEP 192:sxRRRyyM/jK1Ml8wc//fNs0019wZPqtxGzoA8p4JS/g6+WNIYyNJr+GSIgDIJ:sxRREC//fNs0SuP+d9/5IZrYw
TLSH
T1FD62D915AA3499778CCBD209FA517F53D6F95573E2900E44AAFCCA1C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 857947fad2028e7a78f59185ba8819a8d6990f470ad969fbfcb6be30829e0d76
MD5 1b6a44ed76a72f2ce9fb25c6fda8e841
SHA1 bdc6fe5f2a95e393b9b636f5814742a3289618d1
SHA512 db99063c0b472dbcee7b7e2ce5fc5e7221d1d71d8e2c07767f73afe2bb00506d2d9c693ca031851d4fabbe46fa4671fbae08e6b10d6d4797d50e6f915d05d738
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV78fcciJro5nKl2:AIox/OE7p0WguMfnAu1jaE8fXii5KY
TLSH
T18BE2EB3B680CCB7F4F80499CEC29BE8A6DE801CF96D8CD9447FA851C03C66EB55165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 062ddf0960a20120a5a3aa1cd811f0fa1d2aef40ae15175be5a99af356a46db7
MD5 3b4170059c554f7ed00c2f55a4961bb7
SHA1 2a0a84cabbe0710e3ccb8b366ab52ac01f343ff0
SHA512 9ad5a627fb9e0a13fccc36596d8f661a891b128afeea3b6192164d98635fdcd764f0585f047b6042f61bd5f6815dd4b9ba9d5f4263be36ada7de00f557192cea
SSDEEP 96:K8wQKpiWeTOKQ8II5MYKWaAW+jTgAAK4VgiAcQATCoNHRu/bpLP7z:yzZbI5MYKWaH+jMA0VgifQATCoNHRu/9
TLSH
T129910400747F17403C7E241D86AC982A9181349B379A752B3BD855E32B2BE515FFFAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42b04a4a-dd42-4dd9-abb7-d31d3e1dc9b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\42b04a4a-dd42-4dd9-abb7-d31d3e1dc9b8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 df42e597f29432b291d18603a8e365097980d23300eed31422185b320463babc
MD5 9b03c96b3c8572d4818fa8700033cc48
SHA1 303a18855ca108e4d6c44a22d12b8c8d04242b4b
SHA512 63fa61f4ac4fb458ab336a2e50e9f9fa782477dff5a4fe2531991f72fbaa03ae39434504ab80e73f0709fa11168019f71d45c56bdd938af7fec1dceb8c432dc6
SSDEEP 768:iF1j+9W3nwgk7Qv46QGrOJIITu/hUAFjQIMyOV3N5E9Eib9MJ:X9W3YVTyhNFUIpONNmDb+J
TLSH
T189038C36E891DBA7ACE79BC5B7067687EEE001B785C95DC4DADDAE0801832DD034BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c08e70029ef9944605b05d52b7b1d4c9335baafd0f25dc8b9a459490e24ca323
MD5 ef4c1b4aac9cb701406ccbc1efd72a0c
SHA1 8651c7a6fb546feee288de3e96ea4db981078397
SHA512 a9cc46354c8a4355505a8c1bdeb6ef1241e877a91c03fa68a6e9f36b45bc161d120e4709247128433e5a9f23ca0eb1f178618ee9128789a8ab6776c4d63a4f7b
SSDEEP 768:Gj+9G3s7Qv46QHQOJIITz/hUAFjQIMyOV3N5E9Eib9MJ:V9G3enT7hNFUIpONNmDb+J
TLSH
T131F2AE31B892DFA34CD79785B6063297AFF002BB88C51E44DADEAB0D028329D0757C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c53526fd436af37feedce253baaa7f562c444ac971d561e177a516773c98fd29
MD5 ed89f9fb141a1317159196598049feeb
SHA1 0adbd404422d72d9d97d825bd2bb1119d13cceb8
SHA512 d5ff3459d8f01ee46b6a3df68306e1c254c5a9504bc0ced2cca534508630d202d96d39eec1b45a023d4a8c5f93d2ecb9f3fbc14408499f34cf5f0ca9def65d43
SSDEEP 768:tj+9G3x7Qv16QHQOJIITz/hUAFjQIMyOV3N5E9Eib9MJ:I9G34nT7hNFUIpONNmDb+J
TLSH
T182F2AE31B892DFA34CE79785B6163297AFF402BB89C51E44DADEAB0D028329D0757C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b917ab798af21d40663c42b05248a1b4e3ba4d5722cb2317895cfdd5644bd6df
MD5 15cd7f863005d09d4f6857999127ae5b
SHA1 d7ab7f69dcfcac85168277f6d3276c6364649f29
SHA512 4c9f88ef2c3baf841f8648c73803789665fb5e0afcaff31b8987af5a3aa9ef914ccdee55f4299551f56bf04eb2272743bc78ca171d11a92804caa382f69ef819
SSDEEP 768:9rv+4UNbdF3aK66LQOJII7/hUAFjQIMyOV3N5E9MMg+8r0mL:9bsbf3TdDhNFUIpONNmODrv
TLSH
T1D603BF31E8A4D6B39CEB97C5760A72437FF441A799C20B84C9DE6B0D824B5DD231BC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

8e53257b-b0d7-4173-a933-d428d31ef47b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8e53257b-b0d7-4173-a933-d428d31ef47b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4924_613406278\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download