ef1990355254c36fcb47c6f5957f90100389066a54b4c0b78560f2cfe303a0b7

Analysis

user interaction
yes
max time kernel
42s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
McLovinGame/loader.exe
Size 1.5MB
Sample260808-nbehaadb82
SHA256 ef1990355254c36fcb47c6f5957f90100389066a54b4c0b78560f2cfe303a0b7
MD5 d6b0f6406291a7aadeee359fad184b71
SHA1 397b07c416734ee7e9d6175bd0bb9ef8d2ae056b
SHA512 2b0dc476900609d50b0796ee1d596f888d00fe0945b39417b2cfa07b278aa1e17636f43370e8cf474d2655257e7b932cfcfa8ec87a6d2da6537a1cb5d150004b
SSDEEP 24576:42ctIvKqwpMKvT7QvYMy91tA2DP2crkmQNHElqKlRRaBIqHxXyM4M:NToMKvPQvOi8AmQNsrlLaxxXyA
TLSH
T146659D4B77B2C1F4CB66C1BAC9E11233DE3674641B3897C72160CA1E9FA3AD54A35722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\McLovin.png	loader.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\McLovin.png	loader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306612016651467"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{20F1D9B2-01D6-4C28-936C-6D5276581541}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2336	loader.exe
2336	loader.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2336	loader.exe
2336	loader.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 3252	2336	loader.exe	85
PID 3252 wrote to memory of 552	3252	msedge.exe	86
PID 3252 wrote to memory of 4940	3252	msedge.exe	87
PID 3252 wrote to memory of 4916	3252	msedge.exe	88
PID 3252 wrote to memory of 4916	3252	msedge.exe	88
PID 3252 wrote to memory of 4916	3252	msedge.exe	88
PID 3252 wrote to memory of 4640	3252	msedge.exe	89
PID 3252 wrote to memory of 4640	3252	msedge.exe	89
PID 3252 wrote to memory of 736	3252	msedge.exe	90
PID 3252 wrote to memory of 736	3252	msedge.exe	90
PID 3252 wrote to memory of 736	3252	msedge.exe	90
PID 3252 wrote to memory of 1772	3252	msedge.exe	91
PID 3252 wrote to memory of 1772	3252	msedge.exe	91
PID 3252 wrote to memory of 1772	3252	msedge.exe	91
PID 3252 wrote to memory of 2888	3252	msedge.exe	93
PID 3252 wrote to memory of 2888	3252	msedge.exe	93
PID 3252 wrote to memory of 2888	3252	msedge.exe	93
PID 3252 wrote to memory of 1800	3252	msedge.exe	94
PID 3252 wrote to memory of 1800	3252	msedge.exe	94
PID 3252 wrote to memory of 1800	3252	msedge.exe	94
PID 3252 wrote to memory of 2548	3252	msedge.exe	95
PID 3252 wrote to memory of 2548	3252	msedge.exe	95
PID 3252 wrote to memory of 1476	3252	msedge.exe	98
PID 3252 wrote to memory of 1476	3252	msedge.exe	98
PID 3252 wrote to memory of 5012	3252	msedge.exe	100
PID 3252 wrote to memory of 3504	3252	msedge.exe	101
PID 3252 wrote to memory of 5012	3252	msedge.exe	100
PID 3252 wrote to memory of 3504	3252	msedge.exe	101
PID 3252 wrote to memory of 1900	3252	msedge.exe	103
PID 3252 wrote to memory of 2320	3252	msedge.exe	104
PID 3252 wrote to memory of 2320	3252	msedge.exe	104
PID 3252 wrote to memory of 3332	3252	msedge.exe	105
PID 3252 wrote to memory of 3332	3252	msedge.exe	105
PID 3252 wrote to memory of 4008	3252	msedge.exe	106
PID 3252 wrote to memory of 4008	3252	msedge.exe	106
PID 3252 wrote to memory of 4456	3252	msedge.exe	107
PID 3252 wrote to memory of 4456	3252	msedge.exe	107
PID 3252 wrote to memory of 1420	3252	msedge.exe	108
PID 3252 wrote to memory of 1420	3252	msedge.exe	108
PID 3252 wrote to memory of 2208	3252	msedge.exe	111
PID 3252 wrote to memory of 3152	3252	msedge.exe	112
PID 3252 wrote to memory of 3144	3252	msedge.exe	113

C:\Users\Admin\AppData\Local\Temp\McLovinGame\loader.exe
"C:\Users\Admin\AppData\Local\Temp\McLovinGame\loader.exe"
1⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\McLovinGame\game.html
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7fffd007c188,0x7fffd007c194,0x7fffd007c1a0
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,16211110927691287201,15758940767107762454,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,13948362454184685275,15232755221210579167,262144 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,1790092927240180000,5492905695133609881,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,16118323224386593171,2137429777950721349,2097152 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,4273655458257683347,14744430050472899829,2097152 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,10553521904291652190,6781888013217351756,2097152 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,15083329522023957567,3130801391007383686,2097152 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
    3⤵
    PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,9069953954315452194,4717678990184390483,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,7116498264820097115,17217042947199148576,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,2714851549203101191,3318220273247461787,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,17853241709314935305,17176861143028160788,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,7732108440274127650,11538099786269021444,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,7732108440274127650,11538099786269021444,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,150174485999493302,14313669272058979049,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,15929781589942422389,2044835717502419654,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,15967635447099810091,12696688522844645241,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,16694190131537633685,18266234849071302753,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,15872271740698991373,15145515873967579892,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,272029918553205972,15831875378355638323,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,2330134032907629039,2100468838840623813,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,4497054738549276201,7675539008135922905,524288 --field-trial-handle=2332,i,15548849644037506369,13923033205293017006,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
    3⤵
    PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ff866523a00ad7be4f57ed3dd35220f650716ef0e394940411c5f5c490641192
MD5 2cd42bb708a8db0c9ad673f22c1d0594
SHA1 a2fb5604ca35ccedbe1580d3dec6ae880b45a6c1
SHA512 fb5ddb95aeeed437e928e1d2f9fdb43e7b5d1718308daa77f39127fcfeb9ebf389698d2d875ef44bfd48b2980a39a711c0d8bd6175e5872174d7cf5ea72cb0e4
TLSH
T17471F92D040E49A3E31D2732E0E3098AB274CD944FD74EA35438993C578EB56CBE546C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588028.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588028.TMP
Size 3KB
SHA256 3224d05d9636fb0ae0e9e2a6ff680042105fe1029788dc98210241d938496b35
MD5 255de81de825bc1931d80173259e9935
SHA1 1b9d7f3b5354d3c1673dfa0401a30d4b6385ed44
SHA512 f7ef5a349a5e7e5fbd31896b4758c92ad9219cce1a65a526cdf6e54bb7c1a86403350a4f0a3f5ce8769c4469960f51f3d8526818ca382564f0fe1415d40e388a
TLSH
T19671E92D084E49A3E31D2732E0E3098EB274CD994FD74EA35438993D568EB56CFE546C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b2bfca3efb88ff8bef09bf29b66a44a24d6d1c27b75bdaefdfda615f9abde06a
MD5 117c73022714b3456c6721ffbb5746c8
SHA1 23d252935d4a92089a439d5929ebbf76622ad800
SHA512 fbbd7d81beb5342a301ae5802e5350ce6e981451c3da1f1b4787d2294297879256599e68187d7ef6664979f586e95f51c3afb97b8da66f70c26f2d4e02d8927b
SSDEEP 192:sxZFRGyM/jK1Ml8Mi1/fcsww0IdpdEHW6+WNGYHjYd+HIg4J:sxZFcq1/fcswwtKHbGDYc
TLSH
T10F42D612AE34A977CCCBD20DFA557B53D6F50472A2904E44A9FC9A1C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 f759ade56536a07c9a6e0a689ec4e1c7a37bdaf1d10858fd76f9a72532311591
MD5 9ff2d80ba211b7e6bbd10231178fad85
SHA1 a1992aed0e2365dae5c4c6a2120132be92a33abf
SHA512 dd078a9a9fdb9cb60df413b92612af1e59d3e6723ff3ede0761cefc5ba890950516d94e837cbd44d3ce850b00b4803b2df19d29eb5d57969fc00fb5fe86afbd6
SSDEEP 768:7SUZYM77pLuLfgMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9xCeLlPZ4RUrow:7SUZYMNEfgMWvg0Pou1jaUxCeLZmR/qp
TLSH
T12BF20B3B7C0CCB7E4F844E9DED2A7E8A6DE8018B5A98895447FA844C02C76EF11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 13d55c9b3e3db77c00da6f4b11e77b2df6058400ce7d6e7d1e43361739ad0a12
MD5 5d02a9791aa4be7764f3aa1b830a2df7
SHA1 5f96db1d2575ef2eac78c589556150b9be3b8591
SHA512 aa411f3c2a830d44f9d09f229b4ae772301106293e1911337b3d2aa023ec76c7e0431eaa03870ae17ad6c9040aa0bc7416e9a9e324bc24c05172b38664949d7b
SSDEEP 96:KA1eK2AMaMKXqOCOkKHqUdOKmkS2LWKEgf:EurfyVle
TLSH
T110D1E00276BB02033D3D2918A39987764F85F6A33418A42B7FA840B55E67E345DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9248daf885ff3a4ac9335002c6f121a62a0508e7913a3489ba60cebe52b8231b
MD5 7326fd2b1905667a0171a55a2eeef0e7
SHA1 87c444663725338e6d971e1cf2a7be4209167a75
SHA512 8778a072cc87bc3a0b4b0e7560be26e62d1f3b39d4dfd096cef62812c81fcb480085fc7cbd0ee53a85d4da412a1bf26ff36edff0bdc58197b73f1c689e53dd34
SSDEEP 192:uuOLsNPUKQxteatLp7QmiU1FfuF67v4zX5Obd+j1jzory0aouX6EP4QGqd9U8:nEsNPUKRgXfjEzX5od+d8y0VuXRhTU8
TLSH
T19B322931A828AC275DE7B149F54B32939FE410BB9A846F94E6FC5B0C009769C271FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5cd9c2ba50c232aaf3b2527336635f3c513efc5c81e246f587f2eaab4ddc882c
MD5 029653119c5e658a86ecbe753a484355
SHA1 5b1b65450621670ba6b16dee89cfffab0ee4e585
SHA512 daf9dd2b3d1cbc2d0414e0a621a94fd3a07d40f353169d293b721507972b790f0037671b81b1ad8f1b4be82dc8f45466af9e186d578e93d1d211fcbd705ff44c
SSDEEP 192:yONR61VWQmiUyFuF3gGX5Obd+j1jzory0aoX/a831IU6:yONR6WTgGX5od+d8y0VC2IU6
TLSH
T1AA02D835A9286CBB8EE2BE4AB48737139FD51067EA552F84D6FC1B1C009769C2307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c2a33a358db8a99638b97fbba2e6b76dd0bfdd1154dfa75ddaa3186a4164e857
MD5 8214a75507333be884f08e94cedb4b82
SHA1 2874a0a8bbc3c5bd94c93ee7928fed962cfa36f8
SHA512 1e5a839856f447678fdfe7be21c623aabcff0f311e2e628a9c06a1755d780d5b038018d97114cc5ad5035a1a9a8d0cff18eb79ff8ef3c0a2d3d403bcb350c3b2
SSDEEP 192:XONN61tWQmiUyFTQF37gGX5Obd+j1jzory0aouX6EcjJGqd9U6:XONN6ioWEGX5od+d8y0VuXR0TU6
TLSH
T1AA120935A429AC675ED3B549B48B32539EE410BBEE45AF80E6FC1B1C009769C271BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fad24502136808b0f6eb7a4711d73a91cb5573a800951abf0057272575406976
MD5 205e1f5ddb8437e9a05b0abcd435e196
SHA1 9cac092b474e65f7db6fe15a5d81cb447c2f690e
SHA512 6aaf451253dbd5f91c36e789a0de2719e2f7ebd7156990c684f808409db282ff0ab9803dec7ccacec9ffb84b820dc3d6e447ae770d712a40c6e5d54cc4c7a1d1
SSDEEP 192:uuBLsNPUjQxteatLp7QmiU1FfuF67v4zX5Obd+j1jzory0aouX6EP4QGqd9U8:ndsNPUjRgXfjEzX5od+d8y0VuXRhTU8
TLSH
T170422A30A428AC275DE7B149F54B32939FE410BB9A846F94E6FC5B0C009769C271FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 264bca5c7687b5bd81cf91fac4682ac863a49f8d4eca706522f39a4cf81dd57c
MD5 9060a983e4fcf84073c0ce7f4f217b10
SHA1 64b7caecff952f3712661607361c5b9a455010c0
SHA512 41e59ca12aea78b4edbff4219d32c544bc3aa5189678aa4c79ddd1cadb284c47a299e852cf5134459afe29809f59539aeb99868184c4041cc2dae153f1d568c4
TLSH
T10A413B58A6F91158F3B76E1A9BF6B86E487A7D362F06C09D10110E4F0A37B05C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

5059e950-932a-4f24-81ed-709f82b8ccf1.tmp

Path C:\Users\Admin\AppData\Local\Temp\5059e950-932a-4f24-81ed-709f82b8ccf1.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ded5d8d3-d150-4630-b947-d370a5eb819e.tmp

Path C:\Users\Admin\AppData\Local\Temp\ded5d8d3-d150-4630-b947-d370a5eb819e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

64eac9b1-2725-4e80-9fb8-140a3a1c67ac.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3252_355241443\64eac9b1-2725-4e80-9fb8-140a3a1c67ac.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3252_98219426\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads