8ed11ad7f9f278532ddd13a0a5c0603e04461a1ee2c3d16cc38662e075c69a20

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IT/SISTEMA.DI.SICUREZZA/GRAZIE/IMG/Italian_traffic_signs_-_icona_poste.svg
Size 4KB
Sample260722-pgzabavare
SHA256 8ed11ad7f9f278532ddd13a0a5c0603e04461a1ee2c3d16cc38662e075c69a20
MD5 5123ed2cd6e71d9c9735f3cf5ebf113c
SHA1 74b9d76ae269438e32861573a1bda3d0588d1fa1
SHA512 a0120395b4ef43757b5d7d2015ed3dd2a20915400457842de42e4ad84474ac2fda792bf19f2da3de384ec1a9ff4027927a87ad0fc1b52f860db1ec33aff5b1ba
SSDEEP 96:VkoIanLXpcR0iYfLT1yKKwFSsZg3roJKyB6roZ0R:Vk8j/1yOOroJKyBkoZ0R
TLSH
T199A18505E1B28CD4620D02A168E06D12C21E78D3A5D58D767DAD18A6EF820D3337FBB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1990078484\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1537388864\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1537388864\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1537388864\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1537388864\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_844364005\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1990078484\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1990078484\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1990078484\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1990078484\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1537388864\Filtering Rules	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1537388864\Filtering Rules-CA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1537388864\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1990078484\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1990078484\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1537388864\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1537388864\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1537388864\Part-NL	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_844364005\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1990078484\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1990078484\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1537388864\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1537388864\Part-DE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1537388864\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1990078484\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1990078484\shopping_fre.html	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3040	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291963402311668"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{C0CC9FC3-B634-4856-A655-3E9726AD4FFC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4624	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4624	4076	iexplore.exe	90
PID 4624 wrote to memory of 5392	4624	msedge.exe	91
PID 4624 wrote to memory of 3708	4624	msedge.exe	92
PID 4624 wrote to memory of 3040	4624	msedge.exe	94
PID 4624 wrote to memory of 3708	4624	msedge.exe	92
PID 4624 wrote to memory of 3708	4624	msedge.exe	92
PID 4624 wrote to memory of 3528	4624	msedge.exe	95
PID 4624 wrote to memory of 3528	4624	msedge.exe	95
PID 4624 wrote to memory of 3304	4624	msedge.exe	96
PID 4624 wrote to memory of 3304	4624	msedge.exe	96
PID 4624 wrote to memory of 3968	4624	msedge.exe	97
PID 4624 wrote to memory of 3304	4624	msedge.exe	96
PID 4624 wrote to memory of 3968	4624	msedge.exe	97
PID 4624 wrote to memory of 3968	4624	msedge.exe	97
PID 4624 wrote to memory of 5624	4624	msedge.exe	98
PID 4624 wrote to memory of 5624	4624	msedge.exe	98
PID 4624 wrote to memory of 6768	4624	msedge.exe	99
PID 4624 wrote to memory of 6768	4624	msedge.exe	99
PID 4624 wrote to memory of 4212	4624	msedge.exe	101
PID 4624 wrote to memory of 2004	4624	msedge.exe	105
PID 4624 wrote to memory of 6848	4624	msedge.exe	106
PID 4624 wrote to memory of 3436	4624	msedge.exe	107
PID 4624 wrote to memory of 1868	4624	msedge.exe	108
PID 4624 wrote to memory of 1868	4624	msedge.exe	108
PID 4624 wrote to memory of 1688	4624	msedge.exe	111
PID 4624 wrote to memory of 1688	4624	msedge.exe	111
PID 4624 wrote to memory of 3392	4624	msedge.exe	112
PID 4624 wrote to memory of 3392	4624	msedge.exe	112
PID 4624 wrote to memory of 4436	4624	msedge.exe	113
PID 4624 wrote to memory of 5336	4624	msedge.exe	114
PID 4624 wrote to memory of 5336	4624	msedge.exe	114

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\IT\SISTEMA.DI.SICUREZZA\GRAZIE\IMG\Italian_traffic_signs_-_icona_poste.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/IT/SISTEMA.DI.SICUREZZA/GRAZIE/IMG/Italian_traffic_signs_-_icona_poste.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb26e1c188,0x7ffb26e1c194,0x7ffb26e1c1a0
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,14601452652471321514,15386263540913596862,262144 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:2
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,14771668239830876407,7725627566297926838,524288 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,1668955489296706342,1956482360064028399,524288 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:13
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,1924091188277015573,3748979730922196172,2097152 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,12382647868484546178,11860651199159332601,2097152 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,12525523156678308474,18114363089452767377,524288 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,15116325293263736387,17882941926047835097,524288 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:6768
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,14941017839235891204,10651205950048376306,524288 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,14941017839235891204,10651205950048376306,524288 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1236,i,6137447456037214966,13045700780901697656,524288 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1252,i,13000597565787090616,1224374099260340440,524288 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:6848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,4375732953944755898,1320322083931693596,524288 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,13091864923485032830,11163578927151369935,524288 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,8357745393249246367,5002962975253044120,524288 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,2998458659931220982,12726258286145838180,524288 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=940 /prefetch:14
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6052,i,13822921144408551587,14851505069855802019,262144 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,18144592878345286198,14363125338493805478,524288 --field-trial-handle=2788,i,13620298370849211355,11753749353306163858,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
    3⤵
    PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 5e26f17c7798e26c139b3b89d64a0a41322cc38992f9cb297db6c95b6bb9abd5
MD5 18f3b71ef4297570438efa5a89d2d37e
SHA1 ee5c94bc838a63ccf12ef38f6acab8f1be5a9797
SHA512 49bbc949cec9b90e221ccdea09b1528e1d7b40f1799aeff6c28cfd772b3536099814f5dc335b6493bbd56d18e511353f368486f5871d5aa7120b7b2f5e1f9bdb
TLSH
T155F02DA6D921AC3729FC1B1970544B47E754135B3B41D94B7B3C820C8FB063B4786C1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 74ab82673df1504e437356201c922e538488dfb2091d13f38e1829cc37c600c0
MD5 38ef01b0f1876d8377a2ee543d567995
SHA1 59f5361a0bc196b26cfc474507882aeac955ecb8
SHA512 e0072f3ff1fd6003d6cfeb11a5be14aa0a6fff6f42484956b65e6ce19bac2a915e0feb1f8e030a0bf91486ed2d500246a546001db22c747081c8c99624c8271f
TLSH
T12551AEF783E4856DC90195F0AB187E2BCE1D0914832C7D5A89E0AF1BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 22ca56571e68d39f7e1a2c14d7852d34aa404b19c8a02f3326bb52ba3a218ad1
MD5 0e4ea8fe641322d2ccf911f0859e1bee
SHA1 1ac70d409536a80a9b732212d609e18b08984276
SHA512 906c13f615acee34acce3b3ce8ff3e9031b13c41a208c034fe00cd8389f2c896878480613a29f6a69a8ce891cb98d0cdd075fb347fe66df65bb1fbc48fd7e663
SSDEEP 384:sxRAo8G/fZsGGSN/RI50f/5IW4gsGQ9Mjd:s0NG/fpGQWi/5IW4gsGQ98
TLSH
T17C62EA166A249D3B9CDBD209FA557F93D6F81173E1505E44AAFCCB0C04E66EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4cb3dfeb790ba317215871565a713a653dccc7b495cf632de87f59ea3d15f3a3
MD5 a35237bdcfabc7ac5b0d3ffc6a7474c9
SHA1 e1aebb93321f14a7d2bca135c4ef71f9c30dacc6
SHA512 7fddb2e894ecaba8e9845e6cb22efadc7abdfae98aa9eca85f97f5208094f05af2d583d13002859068fbb2dcebdf0ee3dbf0b9077c535fe82e04af9819bdcf70
SSDEEP 384:sxRAoqWG/fZscGhN/RI50f/5IW4+sGQ9MZV:s0vWG/fTGzWi/5IW4+sGQ9O
TLSH
T13D72E916AA248D7B9CDBD219FA557F93D6F81173E1505E44AAFCCB0C04E66EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f3a68e8731d46dde3dec5456eed6e2317d97a93655f789b6e8347a2d47892401
MD5 d872637c7e45acc5f78ca6ec472fdd91
SHA1 660afaefa852f95a1041ce727e57ac74dd5ce296
SHA512 ac515af3f0913416b215d03e378293e069b88ce6e2b7ecd0cf5d5c4a79739374ad8cf6a5c0d5714a9cd1c655f6ab51a84cf3f4defe6323c537bc14c3c3b00d0d
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAobbDwzroa4Z:Ob4YZnE7yTWg1NfwBu1jaTobHwAlZ
TLSH
T1A3E2EB3B280CCB7E4F804ADDEC29BD9B6DA8018F9AD8895447EA450C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 90b5dfc2dde6030a9499d402bf88eeec31e0428d997e3b81252da4bf25a17b17
MD5 6f254d4a022cbdd5cde6ad2b8f21d373
SHA1 d2646b2a9403dae86144f5b0a80b49cded27e8bc
SHA512 6768bc3467b423fd789652c303306c6b94e6cad911a52ce7b402ea0518155d7eab7161d1f20f4ed7d087e8620df663ab3f245d4b4a257e0aea49eb4aefb5ea5f
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9d5G:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRL
TLSH
T185B24C51713F4680387EA90C91B8981E86C2B4A37459E52F7BAC01B65F67E039DFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ac976b48f09e2f5851046a1e33f45c96bcffe0d1029a3efa5814980ae6960cdd
MD5 290eb80ca422e4abc03eac7d5ab18bea
SHA1 50694f94f92ef48ceb4fe993f633482a4a4ba019
SHA512 c05c78333e33c382795a3b8a7b83fad1fa96b14965398af2b798d3a4cf83581a29fd6aa5cc032f725de38f77a234dc14ec494a53bcd958ae08b35dfe2995375c
SSDEEP 384:n/OiF1tNn/s3n9Sh8NL68TUNTUlIRuPvuTQA7EqfbGGNcA831yHZRyxScjmw68Lj:NF1j+9kQ6wg4uDkGaA8lbx1jx
TLSH
T1BBD25C32EC55CDBBFDEA4A99B70A7646DEE01163C8D85AC4EAD95D0C00C72ED0707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2e7502285b4734b26194567cdb0c75d6a390925f9fcb898e4d1964e4968d06fd
MD5 c94b8f9b1391d7199bd4ad87bf6d6641
SHA1 29922f8a6c6a495d39488ea4b29e51b88d38be72
SHA512 23d5066c10b928a1429df9fcc5b62624259e5fc29bba71d8b80ef4704532589bd930ea3d26353ffec50f9b6490eac9a7b5a5fe8c0a39eb8225f86c925c8cc829
SSDEEP 384:n/EiF1tNn/s3n9Sy8NL68TUNTUlIRuPvuTQA7EqfbGGNcA831yHZ81SxScjmw68H:nF1j+9LQ6wg4uDkGaA8l2x1jx
TLSH
T1B1D24C36EC55CDBBFDE64A99B70A7646DEE01163C8D85AC4EAD55D0C00C72ED0707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1d5c65b9bd175ce2e31c86ca6d2da98a14b5fb43754def706682817174460e3e
MD5 2b274ed8e901493d0d16c336de659c4f
SHA1 d85a55e960a4c882a282f6ed39faff1bdc4fbf05
SHA512 63fd3c7c73f4da1908b83b2ccd339083bb360bc0c058552d0391a6a41157113c0fefa48e7b95114c4ccbaec3694d07d8fca0baa751f64c91098977d6c48beda8
SSDEEP 384:ngiF1tNn/s3n9Sn8Ngg8TUNTUlIRiPvuTuGREqfbGGNcA831yTLnOObjI9G6w7p4:7F1j+9SXgwgUuzqGaA8lYn29M2
TLSH
T12EC24B36EC59CDBBEDE64F99B34E7A46DEE01263859C59C4EAD95D0C00871ED0703C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9b92ff54c9c72156c4522931443224f61b269edd1ebe2ebde3a7750d51c1488b
MD5 45c4bd97083a2664f907de058842d219
SHA1 7185d3a5095d9db039239e611e4fb2a430a7d936
SHA512 988cac3670bcb4cb3276d56d49803a41d368bb054090693d6bc2b498e734a1b784ff2f1a5c3d0722fa98f67c1d6b50ee929cf8992f2513e0ad4e3cf6a493bb0f
SSDEEP 384:ntiF1tNn/s3n9Sh8NL68TUNTUlIRuPvuTzA7EqfbGGNcA831yHZRyxScjmw68LES:kF1j+9kQ6wg4uwkGaA8lbx1jx
TLSH
T163D25C32EC55CDBBFDEA4A99B74A7646DEE01263C8D85AC4EAD95D0C00C72ED0707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4b91056f38270d61a63a87787b6fd49431839e8b578e9b2414652d0825e9f8ce
MD5 e1480390151d60f2508e80f4a5979dc0
SHA1 2139b7c0a546c3f8bc64b6638b5fb0c0bc8bbad8
SHA512 b84e338afd610a783e88eacff1ba9cb5eeaeca64a9d4e5d1cae2fa1064b27b488eedf4de962c0be0d9f8b2abe56710ec779bbaa52c0e74bc1f0d60961ded26c5
TLSH
T14F5141E08C381AD1D4BD0A7FB49B34FC85ECD726F89034397859EA985A7975D218087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ab7bb1ab816113b662b05d6c31a31bf4282c0e4f1921853a957b97743d753486
MD5 cc5579abbe785e2f92018e4bf594247e
SHA1 a6cbd5acbf4a5bf203beb06c92ccf3804a6e5627
SHA512 158235f6665477b40e2409f4072cc7dd208703dbfb56a3aa70929c408d47076f803e35d887629ba727122e9bd8afd86aae7d181aaa573c4b21ef598b57f1b763
TLSH
T1AF4141E08C382AD1D4BD0A7FB08B34EC84ECC726F89034396859EA985A7965D218083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5d7ff00a5258a2e70e19d7963351398fc5d1e21bd3eebd38a87e67d13d96e9d3
MD5 b2a21b22374ef9052538509a9d0ecd38
SHA1 281658fdc61c750f109aaa6e77a1ee1c7ebd87f5
SHA512 a26df02653a597a69233ee83a0b43c48b0bc2b341b2b0b427b16bb4ae322fb489486ecba31ca48b724710ac10a42e66eb7fb232391dd78c5dc5f1fa02c4423dc
TLSH
T17F4131E08C382AD2D4BD0A7F749B34FCC4E8D726F890343D6858EA985A7965D258087F
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1990078484\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download