d08d8cefc21783960a89cfffea6755499860559e53b0645ff5d35ecf0ba2497d

Analysis

max time kernel
148s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v11K-m5-eL.svg
Size 28KB
Sample260730-ckk6msad45
SHA256 d08d8cefc21783960a89cfffea6755499860559e53b0645ff5d35ecf0ba2497d
MD5 f2f7df101c9bf5d75ce49d42491e9f8c
SHA1 bfa147420c27f8f75982ba6d99be1b938f30cd3c
SHA512 85aa10c95f787a0460395f4aaaa5184eefa4b66ebfd48e0931d021752560f69fee8e79a0788d026d5c00ca8258cc558db5121631ce5c6bd0df1410ceb6c76dba
SSDEEP 384:ckwQGRNPUTQLwwizqwaowD66Uu9dqbvCK+E9xrYTxkk4sQsDI:c5QGvji
TLSH
T125D24D6437F83C9B8BCC03478D52EC68465FA8B7C498678D97C7D4E8A988368F76C560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_859481918\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_813183001\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_813183001\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
836	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298511404256122"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{B8AC18EE-9FD2-4DF3-8807-C306DDB3D0EB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
952	msedge.exe
952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2292	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2292	2484	iexplore.exe	90
PID 2292 wrote to memory of 1204	2292	msedge.exe	91
PID 2292 wrote to memory of 836	2292	msedge.exe	93
PID 2292 wrote to memory of 372	2292	msedge.exe	94
PID 2292 wrote to memory of 372	2292	msedge.exe	94
PID 2292 wrote to memory of 372	2292	msedge.exe	94
PID 2292 wrote to memory of 5692	2292	msedge.exe	95
PID 2292 wrote to memory of 5692	2292	msedge.exe	95
PID 2292 wrote to memory of 5856	2292	msedge.exe	96
PID 2292 wrote to memory of 5856	2292	msedge.exe	96
PID 2292 wrote to memory of 5856	2292	msedge.exe	96
PID 2292 wrote to memory of 5880	2292	msedge.exe	97
PID 2292 wrote to memory of 5880	2292	msedge.exe	97
PID 2292 wrote to memory of 5880	2292	msedge.exe	97
PID 2292 wrote to memory of 4440	2292	msedge.exe	99
PID 2292 wrote to memory of 5440	2292	msedge.exe	98
PID 2292 wrote to memory of 4440	2292	msedge.exe	99
PID 2292 wrote to memory of 4440	2292	msedge.exe	99
PID 2292 wrote to memory of 5440	2292	msedge.exe	98
PID 2292 wrote to memory of 5440	2292	msedge.exe	98
PID 2292 wrote to memory of 2544	2292	msedge.exe	100
PID 2292 wrote to memory of 2544	2292	msedge.exe	100
PID 2292 wrote to memory of 4072	2292	msedge.exe	102
PID 2292 wrote to memory of 4072	2292	msedge.exe	102
PID 2292 wrote to memory of 3844	2292	msedge.exe	103
PID 2292 wrote to memory of 3844	2292	msedge.exe	103
PID 2292 wrote to memory of 2020	2292	msedge.exe	105
PID 2292 wrote to memory of 3676	2292	msedge.exe	106
PID 2292 wrote to memory of 3676	2292	msedge.exe	106
PID 2292 wrote to memory of 628	2292	msedge.exe	107
PID 2292 wrote to memory of 628	2292	msedge.exe	107
PID 2292 wrote to memory of 5964	2292	msedge.exe	111
PID 2292 wrote to memory of 6012	2292	msedge.exe	112
PID 2292 wrote to memory of 4816	2292	msedge.exe	113
PID 2292 wrote to memory of 1796	2292	msedge.exe	114
PID 2292 wrote to memory of 1796	2292	msedge.exe	114
PID 2292 wrote to memory of 5620	2292	msedge.exe	118
PID 2292 wrote to memory of 5620	2292	msedge.exe	118
PID 2292 wrote to memory of 952	2292	msedge.exe	119
PID 2292 wrote to memory of 1440	2292	msedge.exe	120
PID 2292 wrote to memory of 1440	2292	msedge.exe	120

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v11K-m5-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v11K-m5-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffe4c0fc188,0x7ffe4c0fc194,0x7ffe4c0fc1a0
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,9859758039697770987,13327705579073541815,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
    3⤵
    - System Time Discovery
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,17496256559773205076,14986362834293529501,262144 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
    3⤵
    PID:372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,10831449512130347206,2840372858634498308,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,4397036434137761125,10135336946555616308,2097152 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,6211523987582009780,1950082438870374982,2097152 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,6171143817882899905,8195360071190423055,2097152 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:9
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,11968133230313169243,11162863698503628566,2097152 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,3729851297716627677,15712427047811957376,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,4136541016867632175,8973061060798284726,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,2865029873452693484,2402808652370203248,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,4609116215480479393,7846389032498741175,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,4609116215480479393,7846389032498741175,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,2622841033663878810,4951725452364883768,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,18310353224863807553,15824506578914569870,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
    3⤵
    PID:628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,1448270556907645802,15037711884097636811,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,14285388497023731859,17783446033282938706,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,4402606992135110518,887466190784705144,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,6722871263727861284,11358843970128492029,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:14
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,14630390396408893922,10130364157805516616,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3480,i,8468503009580035506,15762030021798268577,262144 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,12623198963140560865,16052105530379684129,524288 --field-trial-handle=2336,i,7583868240271731846,15519614727657158011,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 bd78aa7940401f69c65527d8feba9f68cd8b265b8f665f4faff716f1897f3843
MD5 79984508de0b127dc1680cff99b6820f
SHA1 f4764fc468829d670605480de57a4d159dc0b86f
SHA512 fdca4d0dcaca394fc557bbecf1a7f2d0cc17b180913b05aab6489b4313f4f55d7ccc6cf3c505b996ad5a4467c9f82eab7735637e118f9b145ba771f4773be985
TLSH
T176512C1DA33614D2E3240772BDD394883FF5CC9A08075E1BA4409EB868C2F17AED2AD7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59db24.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59db24.TMP
Size 2KB
SHA256 946f949b02c12c64abe3e28628b1efc316463bee7df2c245577cba5497fd48eb
MD5 34616e4ad7f617d8ceeb81d0ab4989b3
SHA1 c097c10f75767381b988800825376593e7472a93
SHA512 29195e0df6052d44bd1d2b43dd60b74806dd2937ed65687dde0d4bf39ca333110af96475e209797f09e08422d05676513caf74ff25fb68ef0a6070448235c1b2
TLSH
T1C5512C1DA33614D2E3240772BDD394883FF5CC9A08075E1BA0419EB868C2F17AED2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d53eee44b6d07947cf1943728ac8f5bfb045c2164f07db5785be810f57000370
MD5 5fc8224a320e272bee5069491440397f
SHA1 863bc3c4f026225982f3605b00a26483a0f03ca3
SHA512 5ab730200d128463596f0e56dc3fc27f247a8081edbc27cafec78557703c26523eaa2bcb90f5bb63b773590dba558d251c8749088cc1aeb770498ec5a8f1eb4c
TLSH
T1AF519CF7C2E8866E891196F0AA186E1BDE1D0914832C3D5AC8E4AF6B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f5d3f792ad362e2963f091c2185693d5c810d9339f0d52a6e7db27f583e98176
MD5 91fc5eeedd80b7d7b7c80e5e31725a8b
SHA1 80507f79dd175ec27742a630f408ea2ee5f76909
SHA512 3a629663ce7ab90952aa67c79ddd966490645f6d65fa247c05e9fd2fc422cb4ba0dc0684b2334758ea1a07bba35b1666c31a6509ba0e4b6b5ea2b25e60297719
SSDEEP 192:sxRDRFCT/fVs1h7ZNezoA8p4J/g6+WNIYn8eoq2GkIgDyNJ:sxRD2T/fVs1h1RU/5IT9q6c
TLSH
T1BE42C71A6E28697B5CCBD219BB557F53E2F91033A1906F48BAFC8A0C04E76DD530780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b30ff1f55e73b3c6f96bfe755a16e1ef3696c2680161c207dc77045ae1d24f2c
MD5 9e75c68dee2deedf16fa15502293b2a3
SHA1 2fb9cf7cde4b9cb29b7afba303fcabbc97884b4a
SHA512 b54afa5ddd33483981e078c17785c379246872037697e88653ca64aad01c30d0f300637389af51890c76ab7c640b2c94c2a79c176e818b03b5e558f2c1bb67d8
SSDEEP 192:sxRoRFCT/fVs0J7ZNezoA8p4J/g6+WNIYn83oq2GkIgVNJ:sxRo2T/fVs0J1RU/5ITYq6Z
TLSH
T1BF42B7166E28693B4CC7D219BB657F53D6F91033A1906E58BAFC9A0C04E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e00077092e0cc7a60c1ed8f7a8f30a7e52aaaa47194376379d7aa96623e09b35
MD5 3de7059314f57bd756965679b5d0438b
SHA1 10a3c7bb0b14b096f1d8f9eb359729c3f8eb56f3
SHA512 1ce8741204983f5e983150b1586a57dad0ebbf14b48f70c3d270ee34e64fb705fee3d8d8dab15a091d0b9526e08f3727e614baf5a104d7804744d3f306b89a95
SSDEEP 192:sxRDRFCT/fVs1J7ZNezoA8p4J/g6+WNIYn83oq2GkIgDgNJ:sxRD2T/fVs1J1RU/5ITYq6m
TLSH
T10B42C71A6E28697B4CCBD219BB55BF53D6F91033A1906E48AAFC9A0C04E76DD530780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 95c35c61882ecb6bc37d37ea17066aeb1841aad574c3342ca51dbb7d54695d19
MD5 d3a0cb32aeab9b59dc09db464ed49a47
SHA1 ea7ad7a99f38d1c59f32ec35c5eea16906035e20
SHA512 e04a545094f0a0d07107a1675df7b2c5c4ebd0fa41cfa28cbbd1c718dcb209f161650ad50409a4047f9978d923fda27b25e354b668375663aa7ea4d3d0e973df
SSDEEP 768:wb8d2g7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVv7dRu46HrohVwi:wb8d2sE7r6Wgouf6Mu1jaw7dRV6UEi
TLSH
T1B7D2DA7B740DCB7E4F800ADDEC19BE9F6DA802CB96D8C94447FA851C02C6BEB51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ba35d528b95c06b0a4f7192b62b5c33a91f2349b736fa220e294df580770069c
MD5 6b4c27fcfcc04317bad7b09c480c203f
SHA1 986d4de64a076a18a40c501896e20e1275595b00
SHA512 1e48566b2b7445b7072900a243c437920c0717d4e10e65739a47e1d9e3769996074b3ffd9be2f18c5b4336d2961ecab133ac98f56083d7109e81ec3ffc1ea429
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHU1gkeCGEWCPvgsEK4hgmEcEkvevcQKheY:CoZs4q26neDsgU1gC/wgziItHU1gkeCQ
TLSH
T1F091D050703B12C4383DA51C95B4985BE6D178A3706DB8AB3FE851654F27E038EFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ed9a58ef5eca29cdb61dc4e482eaa686ed225b41cec972414c5f79c3ac2d529c
MD5 d75140183e2cb9cddd5147a259b8d779
SHA1 9cf3e31f8aed9724f7e3b20ccf99ac178501c954
SHA512 00148d223c3f2e34ca160d799e3caf7385b99791fa4e787d23fe3cd9008adb97a75a2ec0ec35d652dbdc1e15aede9aca3cb68003fc2b37b4b5ba77a5a0963887
SSDEEP 768:6rv+4UNbds3tkDZIO0ZaNzc4ReyIsXWeVH1S5D:6bsbS3atc44bsmEH1Y
TLSH
T1BA03CF32E8788937ACF66785B14B76533EF8512782D81B94C5DE2F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 632240488b64637137adf0642e4b5b4989820d0cfe163b1dbfb99cdbb69525a8
MD5 c9c73713989139f2c47bbfd56be589bf
SHA1 5fb7ade6e0bec68b71b111e3a79747759323bc5b
SHA512 3bca51c44e8c83f9fea9588b06bc2e4c915d1f755c6c9c8ab5b7f0f18f1a820ce8633265d64943767882481882fc4b731b8d0e0fb74fac9234ca53a761c791c4
SSDEEP 768:erv+4UNbdb3J7pDZIO0Z/jNzc4ReyIsPVeVH1S5AV:ebsbt3Jytc44bsNEH19
TLSH
T15313BE32E878CD63ACEA6741B14B76937EF8522B81881F94C9D95F0C0A471EE135F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 242523dec1e57efd422ef08d4d4cc9e8e8bbf91f7259ef781ea692710ca317fa
MD5 59e2890baf8ca0164f6ff604706301a1
SHA1 df41afcca5cec83abd70ba26a22e5b47d1241a06
SHA512 9db3debd7830dd74d6640fe91e3cba78139cca30786298e75a8ae0885a75c0c86895b9f40fa268b43c1549f52f24e8ace51138d68922e3ce486a9c133605be62
SSDEEP 768:xF0rv+4UNbdU3+wgG74Zw5O0Z/DNzc4ReyIsPVU9:kbsb+39ltc44bsNU9
TLSH
T13E13AE36E868CA7BACF65782F24A7683BEF41167C5C89AD4DAD95E4C00871DE034FD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 82858c9b539c3d12b1120d5f12b1f66c5270ed3b560fa609c1818d56e054033e
MD5 4e565c1f29af39522af9cafd0615e3b7
SHA1 99f626dc1f51118518e65459e4f2d1ce6df0eeba
SHA512 b1f7d58459679760c65be1166dc3b10974ec857c9939b3b623ae86ce20665973e0f3070be1977b2a5eebfa49012280533c724a703f3c9e773c8390aa6efb7719
SSDEEP 384:n6iFiZcIL38Nl8TUNTUlIlu9vwOouT2Z/fQxXOVSUURXvFAiXSFcETRzcoXfK86Z:xFQL3+wgE74Zw5O0Z/YNzc4ReyIsPVUR
TLSH
T110F28C36EC64CA6BACEA5782F7457682AEF01167C5C8AED4DAD95E0C04432DE074FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 32e45c3d939ba75e906f98b3c078873120bdefb682f9aadf8fb2e2ae41471ec3
MD5 73474cd4a1879937a83360e0e6d01e0b
SHA1 1c7bf2f4e46f41ca885c371901d8e6576678d153
SHA512 1ad6d7e4d65830d84234e0574de483ab8088cde0ae9880940dedf8a09b4d702fd220274b065b632d27c2357f3a18f33335ee8735b41a86b6e47547d968b87146
SSDEEP 768:Rrv+4UNbdb3gvpDZIO0Z/jNzc4ReyIsPVeVH1S5F:Rbsbt3gmtc44bsNEH1W
TLSH
T10713BE32E878CD63ACEA6341B14B76937EF8522B85841F94C9D95F0C0A471EE136F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

73314d49-febf-43f4-aa75-9b494d70ca23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\73314d49-febf-43f4-aa75-9b494d70ca23.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2292_1531981947\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download