e22854a5f93a9bce2c8dcffd9e177925074bb0e0972566d673e4b83022c9a46c

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m2-eL.svg
Size 3KB
Sample260802-symvdsck6x
SHA256 e22854a5f93a9bce2c8dcffd9e177925074bb0e0972566d673e4b83022c9a46c
MD5 735c5dd9687af27db46d1760af81d1a5
SHA1 0362449843acc75186d102a08af6cf07a5b90853
SHA512 26772d0a891c6a143982ad5a722edd3afac15222392ad8c66bec616770bd539ac0f223fe367a8615d39c4c5ff3ffbaccfd34400adc4c2fd98fac718edffb22b1
TLSH
T1AA71288876F83EEBD7D802970D41D4B84B2F946BD822978DD3CB94E875282AC735D570
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4244_1722630054\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1652	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301583387625058"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{474CBCAB-343C-4099-A037-A5E431F58F30}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4244	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 4244	5532	iexplore.exe	89
PID 4244 wrote to memory of 608	4244	msedge.exe	90
PID 4244 wrote to memory of 1124	4244	msedge.exe	92
PID 4244 wrote to memory of 1652	4244	msedge.exe	93
PID 4244 wrote to memory of 1124	4244	msedge.exe	92
PID 4244 wrote to memory of 1124	4244	msedge.exe	92
PID 4244 wrote to memory of 5760	4244	msedge.exe	94
PID 4244 wrote to memory of 3108	4244	msedge.exe	95
PID 4244 wrote to memory of 5760	4244	msedge.exe	94
PID 4244 wrote to memory of 3108	4244	msedge.exe	95
PID 4244 wrote to memory of 3108	4244	msedge.exe	95
PID 4244 wrote to memory of 3728	4244	msedge.exe	96
PID 4244 wrote to memory of 3728	4244	msedge.exe	96
PID 4244 wrote to memory of 3728	4244	msedge.exe	96
PID 4244 wrote to memory of 3680	4244	msedge.exe	97
PID 4244 wrote to memory of 5544	4244	msedge.exe	98
PID 4244 wrote to memory of 3680	4244	msedge.exe	97
PID 4244 wrote to memory of 3680	4244	msedge.exe	97
PID 4244 wrote to memory of 5544	4244	msedge.exe	98
PID 4244 wrote to memory of 5544	4244	msedge.exe	98
PID 4244 wrote to memory of 5044	4244	msedge.exe	100
PID 4244 wrote to memory of 5044	4244	msedge.exe	100
PID 4244 wrote to memory of 4452	4244	msedge.exe	101
PID 4244 wrote to memory of 4136	4244	msedge.exe	102
PID 4244 wrote to memory of 4452	4244	msedge.exe	101
PID 4244 wrote to memory of 4136	4244	msedge.exe	102
PID 4244 wrote to memory of 3008	4244	msedge.exe	104
PID 4244 wrote to memory of 4408	4244	msedge.exe	105
PID 4244 wrote to memory of 4408	4244	msedge.exe	105
PID 4244 wrote to memory of 1872	4244	msedge.exe	108
PID 4244 wrote to memory of 1872	4244	msedge.exe	108
PID 4244 wrote to memory of 2328	4244	msedge.exe	110
PID 4244 wrote to memory of 2428	4244	msedge.exe	111
PID 4244 wrote to memory of 1136	4244	msedge.exe	112
PID 4244 wrote to memory of 3936	4244	msedge.exe	113
PID 4244 wrote to memory of 3936	4244	msedge.exe	113
PID 4244 wrote to memory of 2696	4244	msedge.exe	116
PID 4244 wrote to memory of 2696	4244	msedge.exe	116
PID 4244 wrote to memory of 5280	4244	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m2-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m2-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x32c,0x7ff8ce7ec188,0x7ff8ce7ec194,0x7ff8ce7ec1a0
    3⤵
    PID:608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,9573363810474066942,2498637933956415921,262144 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:2
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,3362803720987409264,6565130545426788209,524288 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,2412254063117591899,1866904924691739846,524288 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:13
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3368,i,9144474130989510951,17702812657545194653,2097152 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3372,i,316006466301142366,13555735298774809612,2097152 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,3631726888561933940,17256443686559439004,2097152 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,7349565910885573556,11156095651987640463,2097152 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,15715847444590784399,6565990999989948204,524288 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,11504421277247509170,16695531232434363659,524288 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,4677227003516971996,13230228692306120127,524288 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,15717401332303193996,6795212053927648741,524288 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,15717401332303193996,6795212053927648741,524288 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,10487454422664417769,15598637485261625229,524288 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,15399055914620909372,9067037110400947754,524288 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,13743291012251837809,168774595314829325,524288 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,13745324327531740204,6670879180219987583,524288 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,1642477930277092072,2927517157821682321,524288 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2417478663624223282,7046077784752446846,524288 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:14
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,10696092007137336567,7730813296641866637,524288 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6880,i,642641645624712349,10429373083415123068,262144 --field-trial-handle=3084,i,17559528805814639858,10897079349133852029,262144 --variations-seed-version --mojo-platform-channel-handle=936 /prefetch:10
    3⤵
    PID:5280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d965b9d42ca24f46233ed7cf661d58212c35c5d066e2ca957c2d044df8c17717
MD5 56ca3f9d9433c93095b051a4c658a51c
SHA1 a3873a06ab215e2d95b2abf944aa5753effcd02c
SHA512 c4ed410f29a8efaf38547911c5f9bc66ba830fc9bbbdbe3c09f1b59d2908cbb814f228546cf05fed9441b72f39f8a46b18bbb5a6ddab0831bec9fdceb7855f2c
TLSH
T1C651864063A73AC1F76F45F53AF1276936F6845E0A476E032240EDF24946F34E8EA123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598757.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598757.TMP
Size 2KB
SHA256 7505cf67c256f4f645c6bb2c4731168f20aaa744069c3a637d9f9f0c54490c7f
MD5 bafef893debe310635b2ba0bdb1a4cd5
SHA1 ebcfcc23e94e7f9d55c0b7b9d89b7390300b3d0c
SHA512 c40a5168076ac0be1cbed6c0d77110e82266d4e16e2742e79da47791f65ebaa60be8be6a9d5f084b2bc66f00f52c7750dc62c57b4fc8c29421e5c5c0344e4bda
TLSH
T1D851764063A73AC1F76F45F53AF1276936F6845E0A476E032240EDF28946F34E8EA123
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fce349586d1510a60e7dd4f6814eeed23a626148bae1ec78e7a220a52e640d80
MD5 34f1103284b82981243f77986f8ebe0b
SHA1 835e5ca14145161e3e6594ed72ee65111954113e
SHA512 9f59ef5a991b1395d1896de2ee0bd218e5d7328d8077c0c437dfe9d6077e296cfe202b77bd4ee2c850d336d5eae8c1f67bb6546f92c762a9fa6f1da1dc394a3e
TLSH
T18651ACF3C7E8966D89015AF4AB147E2FCE2D0914432C3D5AC8E4AE2B97E3471D18199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a6765e29ebb4fbe15b5ea5f8c97272cb41773ed911afadc8db3a0590d1bffc01
MD5 c299ba33e087f2eeb7e57654bfb5a3ff
SHA1 7bbedf1f5c2e8ab601c1303edab5b1e8941929f5
SHA512 93354b079ff05d256be365a8312b50d49bfc2a5b6d2e84d544f7b301271245b60c671a36b15a7ca63ce51e474a36aaadc7a547bf84a574832a4e2ab8d8e3d0ed
SSDEEP 192:sxR7R/C9/fzsIidDde5lSBzoD8p4x/g6+WNIYCyuOCGVIgD75aJ:sxR7U9/fzsIidc5lsk/5IQj5W
TLSH
T11F42B8156E28AD3B8CC7D21DBB55BF53D2F95032A1901E58A7FC961C04EBADD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a8ca18b220a7ec0e8414f695b0bed1cff5de3b2830d1091ff6a7d0ee231380e5
MD5 c9856a6d769ce92416e2eb2189fe8a95
SHA1 1b0372b787bb13c81aa0485fa3ad94856065be81
SHA512 8f0229405fe29798032ac3ab3cd56231e2be308424c69700a734ca80b258f2947f97e51e5d7638e9d64a30bbc7786781b97c72b189ca1e4a58a40150f94dad33
SSDEEP 192:sxR7R/C9/fzsIi/mDde5lSBzoD8p4x/g6+WNIYCVuOCGVIgDJ5aJ:sxR7U9/fzsIiec5lsk/5INjfW
TLSH
T1E442B815AE28AD3B9CC7E21DBB55BF53D2F9503261901E58A7FC971C04EBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2ffce800cf1768342938000cf9798da1e45de5c0bfd8b7694d4856210a2ec3d0
MD5 eeaa3b6fcc8176e73963b04fc2c4e31e
SHA1 1f975efcf7e89dad39941f28ba8ff0f5e8e45cb7
SHA512 4ba700a27e755b7ad1f807ae5e93b80ba9989855855b8f738071c34248a18ddb4e402a036c03b3b544606d4bce8e16ca8279543e9e661cb482e57842c4999816
SSDEEP 192:sxR0R/C9/fzsXdDde5lSBzoD8p4x/g6+WNIYCyuOCGVIgV5aJ:sxR0U9/fzsXdc5lsk/5IQjvW
TLSH
T14732B9156E28AD3B8CC7E21DBB657F53D2F95032A1901E58E7FC961C04EBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2cbd0ed25644dac3f20361f6ee43ebaa5f26137365096332eda04c2315110d97
MD5 5001c62fa9b30538e0108d87b3495e0b
SHA1 f8e160794103f11faa368c625b5d5f2895febbba
SHA512 beb3b1593e2496947884e0c4ecc807572e295da153943811d1883fa8a52d28c3682c44afe2751e3eee1aedde2d92b3fede9f4f5d1cb98238010e72e9782a56f2
SSDEEP 768:jC+vAN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmQqcgroZK:jC+vA7E7JQWgQ+f4+u1ja3VcrQ
TLSH
T1DCC2EA7B640CCF7F4F804ADDAC197E9B6DA802CB5698CD9047FE941C02C6BEA52194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2358.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2358.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a1e3e25720499a88253dcc3fcbe4d1a7070cd6bbcda4bdebb3d1d4e443e03fbe
MD5 121f912b24290585b01fb2df84d4fd23
SHA1 b7c0a9d0f4ad8639da39e0d41df1ef6cca07a377
SHA512 8ce2089190d32c47d07d95861993b439e6d278464c1670a221d3d55ef71d257c2e87704e42b5cd9de8c8ac2a1f9b5145b470327b317437a36fa3db07a22619b6
SSDEEP 768:3L3ejHYgpp8+p3bd66j+4BRv86aLIWu2ewBKZOGWa:3L3tgX8+p3Z6n4ys2evZRX
TLSH
T1AEF2BFB1F8A99C738CE5D648B6963743AEF85163E5C01E98D8DD6B1D00522AD170FC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7b64aa09d0740a20ff888817d6df7959f5736279fe9a78fa14cb020230ae1ee6
MD5 033eb9c761efeaf16db369280c0cf475
SHA1 a4d61b123fcf655cb31b7883cc98590fd3e520d3
SHA512 5245ed39caafd28b43aa8e8934bb8d92638760f80e3052a42671230325fe83e02b1ef22e02c2ddd393163aeb75fd76339a3de3e5a907350f18fa4931a5971cba
SSDEEP 768:Brv+4UNbdA3eaHYgtp8+p3bd66j+4BRv86aLIWu2ewBKZOGWW:Bbsbq3sgr8+p3Z6n4ys2evZRb
TLSH
T11013BE72F86CDD738CE6C648B14776437EB821A3A5C01EA8D8D96B5D409629E270FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5315e7e7b5738870baaf628366edff774f803cb6b6f234944226a125bd13b5cc
MD5 addfd0d3d5dd8560e3d3b97f929fb290
SHA1 f6d17fed8fc0ae073dc029d23baf69bf88308371
SHA512 7500e886c2d0413c024b6e009516559d83431029dba068cb5924c5af8c0a4f5e6e87830bac4d4ff19cb943ef1f5bb03adbf8849110a1b31d0df5d61664edbfe0
SSDEEP 768:rL3ejHYgpp8+p3bd66j+4BRv86aLIWu2ewBKZOGWa:rL3tgX8+p3Z6n4ys2evZRX
TLSH
T1E2F2BFB1F8A99C738CE5D648B6963743AEF86163A5C01E98D8DD6B1D00522AD170FC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9866f225abba7e19d13c9934b60a7ccc1bfa3ca5df9e7c6e952516b8dd2282ab
MD5 1520afb8a71ff41cec8f98cbd3f55c5f
SHA1 21d205d09914b98e951a01858216b70edd88008c
SHA512 1e7ecca237f8ffb641a2f51cfb01e3378821197181c84df43ecdb9bd5857285a9c0aaba22435c4e6cf7aeda6417fef58af9ad1497c9a667630174987b576e00e
SSDEEP 768:Irv+4UNbdD39cYLNp8+p3bd66j+4BRv86aLIix2bwCl1:Ibsbp3xLL8+p3Z6n4yf0ww
TLSH
T14A03BF73F8A899739CE6C64472867A433FF851A396C10EC4D5DD2B4E415B29E230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 be587286b78979d3fbe727e686a8f652cba2e15f3ba5055f79d13b5630d47158
MD5 7ef4ca05ab173acc1e73a38abe93961f
SHA1 c204f2cd468a1f401cc7dbca97719379f9621965
SHA512 7d664999322647c8de523fe4cad222479f7215619af7fa6b806d4d76a7371143e443826f283289ae26a236dbf7d8927919d6824f44a36f15f95680433f1d2931
SSDEEP 768:GL3RjHYgpp8+p3bd66j+4BRv86aLIWu2ewBKZOGWa:GL3OgX8+p3Z6n4ys2evZRX
TLSH
T124F2BFB1F8A89C738CE9D648B6563743AEF86163A5C01E98D8DD6B1D00522AD170FC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 70116e906f99a5070d53471d915ae52afefead7b4f59676f0f767b1b1b64afed
MD5 502ca19ce725a57d6582c37f6f1ceb2d
SHA1 c34e8d049655fb58e3de0029c76bfa88ac39769c
SHA512 6b7711469dfa006d01e44110faa6b6f37260dcfc9815a03c0cf434a242eaf8f4e5822fd4c63458db7a3769fb562ea8c3bf5efafbb7d575892219ab51bb3119dc
SSDEEP 768:lFQ33BwgbjUPFp8+p3bd66j+4BRv86aLIWu2ewBKZOGWa:E33uT8+p3Z6n4ys2evZRX
TLSH
T17F039EB2E8A8CD77ACE68B85B74677479EE411A3D5C45DD8D9C86F0900832AE170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

a2ccce39-1523-4496-818b-b42306d58446.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a2ccce39-1523-4496-818b-b42306d58446.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe595d97.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe595d97.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads