66ba352347bb76d950affb07d51d3dc22a9e1e0e316488fd409ecb337f490e73

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m0-eL.svg
Size 3KB
Sample260811-3p2bjavamd
SHA256 66ba352347bb76d950affb07d51d3dc22a9e1e0e316488fd409ecb337f490e73
MD5 95b7e2e1d8065db4ac2ce8927e95981e
SHA1 9f303ce03119c2588fcbb4f320794622c61045e5
SHA512 88d142db6604e75c03e021e409b771a60808f39568002c877a1bb39f1dcb57f89da8c819bd1a76d8cb929edd7c1405165884108a2abca02f298c6a497219887b
TLSH
T1E871268876F87EEBD7C802570D51D4B84B2F946BD822978DD3CB90E875282AC735D5B0
MD5 SHA1 SHA512 TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3308	msedge.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1501265186\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1501265186\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1501265186\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_376716059\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_910669773\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_910669773\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1460441585\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1494121177\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1501265186\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1423110574\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1423110574\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_376716059\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1460441585\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1494121177\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
244	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309653395867486"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{E39F7CA2-5E7E-448F-A4AE-148D0B39E6CD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3308	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 3308	5060	iexplore.exe	91
PID 3308 wrote to memory of 1144	3308	msedge.exe	92
PID 3308 wrote to memory of 440	3308	msedge.exe	93
PID 3308 wrote to memory of 244	3308	msedge.exe	94
PID 3308 wrote to memory of 440	3308	msedge.exe	93
PID 3308 wrote to memory of 440	3308	msedge.exe	93
PID 3308 wrote to memory of 256	3308	msedge.exe	95
PID 3308 wrote to memory of 256	3308	msedge.exe	95
PID 3308 wrote to memory of 6608	3308	msedge.exe	97
PID 3308 wrote to memory of 6608	3308	msedge.exe	97
PID 3308 wrote to memory of 6608	3308	msedge.exe	97
PID 3308 wrote to memory of 5696	3308	msedge.exe	98
PID 3308 wrote to memory of 5696	3308	msedge.exe	98
PID 3308 wrote to memory of 5696	3308	msedge.exe	98
PID 3308 wrote to memory of 7000	3308	msedge.exe	99
PID 3308 wrote to memory of 4212	3308	msedge.exe	100
PID 3308 wrote to memory of 7000	3308	msedge.exe	99
PID 3308 wrote to memory of 4212	3308	msedge.exe	100
PID 3308 wrote to memory of 4772	3308	msedge.exe	102
PID 3308 wrote to memory of 980	3308	msedge.exe	106
PID 3308 wrote to memory of 692	3308	msedge.exe	107
PID 3308 wrote to memory of 4132	3308	msedge.exe	108
PID 3308 wrote to memory of 5836	3308	msedge.exe	109
PID 3308 wrote to memory of 5836	3308	msedge.exe	109
PID 3308 wrote to memory of 6972	3308	msedge.exe	111
PID 3308 wrote to memory of 6972	3308	msedge.exe	111
PID 3308 wrote to memory of 4104	3308	msedge.exe	112
PID 3308 wrote to memory of 4104	3308	msedge.exe	112
PID 3308 wrote to memory of 4196	3308	msedge.exe	113
PID 3308 wrote to memory of 4196	3308	msedge.exe	113
PID 3308 wrote to memory of 3732	3308	msedge.exe	114
PID 3308 wrote to memory of 3732	3308	msedge.exe	114
PID 3308 wrote to memory of 2556	3308	msedge.exe	115
PID 3308 wrote to memory of 5732	3308	msedge.exe	116
PID 3308 wrote to memory of 5732	3308	msedge.exe	116
PID 3308 wrote to memory of 6924	3308	msedge.exe	117
PID 3308 wrote to memory of 6924	3308	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m0-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m0-eL.svg"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x318,0x7ff9505fc188,0x7ff9505fc194,0x7ff9505fc1a0
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,16032307665563162862,17504618232235310364,262144 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,10971744025288039367,10989072849745215241,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:11
    3⤵
    - System Time Discovery
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,11915949755995907027,15401926800624552178,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,10275308674655385376,3064414113414388737,2097152 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:6608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,9068076497377781102,8296615632266616825,2097152 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,12977161036473630247,11153127114178860371,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
    3⤵
    PID:7000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,6204579027615858067,9106672374781796118,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,2380891232244117734,12209730925109048971,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,2380891232244117734,12209730925109048971,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,14165065966900558837,2997943892687367612,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,6576190806843592881,9214421685465519772,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,15560993008275964981,4665348642107791579,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,13299194571814713361,7392160199644410407,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:14
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,7659786682934228880,15027426369811826622,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:6972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,14303945840495955651,13723258442698089170,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,17448466616651027580,10585299333433559194,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,13442375396509886050,12822073308636609158,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6016,i,7687352924723453899,1647244350504453921,262144 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,290716562341461397,1322217992965060468,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,11228547387307994805,10058606365960825870,524288 --field-trial-handle=2284,i,5675800135958149316,16422061649937653090,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
    3⤵
    PID:6924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

388c147b-c5d3-4346-aef9-cbf6aa9bcbd3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\388c147b-c5d3-4346-aef9-cbf6aa9bcbd3.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b9272cc1e234a8649d3c87defda3489924d54a7d81d560d27642c80dde440a33
MD5 cf47224ab9412043198f8cc2c92413f9
SHA1 e9ae7f70888ca94dd32a5653a100422b5c2e0c7a
SHA512 3ec54ebe9ae6126a75c6eeacbc3397ed505dab33f6a277b15b06080a7cdd1e5622512dbd00416403ca1433072436afd38739c2577ebdfb7aafc17f906e7261df
TLSH
T19AE0EDAAC860AC275DFC1F186054464AEB80132B3A51990F7B3D816E8FB063B8A87C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e6f878b902519e15f4d13e166c1e24d0819075495970ad27385c45a0e63d20c0
MD5 c0db422ca7ad2732762ca5849b739819
SHA1 53fac4a4ef8c8b8618ec95130465bc832d543486
SHA512 769bdb3baeb366b1a81435396a7fd1355f4c5d8db3603ff41afa3bf9a0731faab5c2425f0ce93a3856d5280f8e002340e2d878f2c3dff2c6039142f7714f52d8
TLSH
T1FC419FF783F4856EDA1195F0AA186E2FCF1D0515432C7D9A89E0AE1793E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 832fda6ec0fc228ef29d5ca7866deb855b9fa2f51b5bc35be102c8c5fc5507c5
MD5 2cc29f75706d4260229ccf30d49ff7cc
SHA1 5d2325abcd7e32e7912237638bde7407b98e51df
SHA512 04577a6b79ff1214a9f6bf9e45cf788584698413959d0a7cc19b955779d97954b71c87746ac83c23c93291df2733e12b97ad1bcd944bfc83bc769fd949826542
SSDEEP 384:sxRuS83/fes4pN/RIoRo/5IW4usGQ4jQo:s6v3/fKrWB/5IW4usGQlo
TLSH
T18D72E805AA389D7B8CDBD209FA55BF53D2F81173A1905E44AAFCDA0C04E66ED2103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c2491c87071d5e48150ad5eac70015af2b34739ae00542e9f8d690b6caaef6f3
MD5 b28089eab5cb5a2efbacbab20b162ceb
SHA1 5bbd380db5ed7aa1642eba604ef471eb67f3ea06
SHA512 27462cbe43a8b3c2b863cf729e7734247f621b2dccb1eb1aaa578309ce4ea6c7f72b987e4b126b6556c6b2fc43935e6928a4799047b1e918975b33ca7ceb8bfc
SSDEEP 384:sxRuSqm3/fes/NN/RIoRo/5IW4VsGQ4wl:s69m3/flPWB/5IW4VsGQJ
TLSH
T1B072F815AA249D779CDBD619FA95BF93D2F85173A1901E44AAFCDA0C00E67EC2103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8aec5daafefb83f35638c76b088f1ca19ed398d6a53cbad428febc9db34493a5
MD5 8c0b9b7481d6a8f09de28e578c18aa79
SHA1 ac96ad9d9db5fe9174bac93a4e3d0c74d98f35d9
SHA512 20db593175a37ed5b791b41e0c4a767a1628a2e70c6eff9685791384e6872f43543a307f76af7e3f3d4e87b296d3b9a7bd50d631938305bd4d1362e43a9714ee
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRobbDwzro84N:Ob4YZnE7yTWg1NfwBu1jaCobHwADN
TLSH
T1F1E2EC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA450C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 83fe02b7242396591d1d2f85fa6e6dc6f92c6e34ce5afb70ce52fa60f5ed86c6
MD5 aa749df59848d37a4e0c3f958bf3940b
SHA1 4a25e3d24f412cc3c1f1a849addec1b260dea797
SHA512 ba7c92ad095cd254b5a1bf9d462ca0e70895a8d87204224db40f5a948cd5c8bfb1d511ae3b0246a02d6283a7d51730ce550a68de493d376a0c1d4058e273ead6
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EkRC2kyCtmfyuIwB0ns0X+CJDsM:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRT
TLSH
T127B25D51713F4280383EA91C95B8981F96C2B4637419F52F7BA801A65F6BE039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5116de147884c6a91a3ea030ee943f457c80f73fa6f7fb143e01567ae67b19e2
MD5 7935024823f8cf06de1f2b42337662a7
SHA1 c2f99356cfb466aac0f7b7e98a06b596c35d0cf6
SHA512 28030abecc01e0b2171a0c118acf260d96ba0bc8613a9af2f7f35ef8b0e52686e5e649d02845811951a9f8862fac7b1b067f31a144e9cea836819463c9dc9f08
SSDEEP 384:nA8iFiZcIQ8NLF8TUNTUlIRRPvuTrXzECf+GGrpNdshPWmBp+F5HMMsRnlYuBr8C:AnFQQQFwgfunlGrfdsvPehMhn2ij
TLSH
T15AD25B32DCA4DEB7ACFA8E85B6497642DEE05163D4CC9ED8E6C85D4D00875EE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 33392f471e4a2a3d27d2098e31a4d38370a7490747341068973605947b0573fb
MD5 794aaa3fde707e4ea4f6eca8f5a81547
SHA1 9060fd28cee7c26ab6c27cbd20ed24bdf5ea334b
SHA512 ebf2c969d1e7f622cb8bcfc3765d6ab84f2ff4265ca8d865bde5e63ac2bdeacb44a17705a76f2f0ba50cfb435be7dccd7ed168f32db5ebb1d7b06fd95005a747
SSDEEP 384:nAtiFiZcIA8NLF8TUNTUlIRRPvuTrXzEnf+GGrpNdshPWmBp+FfTMMsRnlYuBr8C:AkFQAQFwgfunqGrfdsvPeLMhn2ij
TLSH
T1B8D25C32DCA4DEB7ACFA8E85B6497642DEE0516394CC9ED8E6C85D4D00875EE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 198ba2a3c8c4d052bd70d132bcdd32f3633550528217d3f6a62bb97aa4c30558
MD5 d9f62da9178e3e6d4ffb7e3ccac92371
SHA1 b03854330dfb1e4f5b65a1eb9f9b9e9e3a54235f
SHA512 afea4fa251beb89c4eba2ab834210733626ca918eccc04b54ec51d65bed5d2248e5ed964f70572988a173fef662ce454d97df7f13a52ddaa9df9610c1d99a586
SSDEEP 384:nfiF1tNn/s3n9Sn8NgH8TUNTUlIRiPvuTurREnf+GGrpNdshPWkLiOObjI9G6w7A:qF1j+9SXHwgUuuAGrfdsji29MA
TLSH
T1BFC25B36EC65CEBBECE74F99B64A7A17EEE00167859859C4EAD82D0C00C31ED4703C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b3b16fc04a3f5156400c6934b4b54041f70c5b334877703d6149b2918e5374a0
MD5 107bd174294d128e506eb6e6a3ce2ed7
SHA1 a9f5d090cbca94b9d34d2633ab68ba5cca80f3eb
SHA512 121908873f266b3284eb62901d05ed7298f9e064d193a4d2ed5438f6156b759975f41b0426f9123f966b6d8e7fd84375c38c0117812ca4c0dc8825e7f5122490
SSDEEP 384:n/iF1tNn/s3n9Sn8NgF8TUNTUlIRiPvuTBAzEnf+GGrpNdshPWmBp+FfkMOObjIh:KF1j+9SXFwgUuWqGrfdsvPecM29MA
TLSH
T1A6C25C32D855CEB7ECEA8F94B24A7A56EEE011A384DC5ED4E6C85D4D00C72AD4B07C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 fb2bc8ad70a3b26c18e2a2d0ff4941d3f8fb5aebb4d527bd15b0bbcbd4562d69
MD5 afd2117675e620ac19a66133d62dd743
SHA1 7671eeb922e0cd1187f1d7953f1b13f9dd97d702
SHA512 20020e1be5e7f8df85e7be75956a670df8327334df951ea4deb034a1b6c870732f094381b74eec4aee99876aa8f9b568d1629801f4b61d2bf6107aeafdbb893b
SSDEEP 384:nAtiFiZcIA8NLF8TUNTUlIRRPvuTDXzEnf+GGrpNdshPWmBp+FfTMMsRnlYuBr8C:AkFQAQFwgfufqGrfdsvPeLMhn2ij
TLSH
T1FDD25C32DCA4DEB7ACFA8E85B6497642DEE0516394CC9ED8E6C85D4D00875DE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d67ec0b83e75ac9d25e93d1335ff1668519744187f0a77db08608bf05d1bb420
MD5 e63e02e00eafa81115853b216717f531
SHA1 aa9823c60057aadb084b11722383184883a725c6
SHA512 24f3dca268efaa01b2d42b839f2c46f839703dfd37050dd2a1c6aa1792d7e4c0c8878730303f80071dd37b5f65f8fef7d7c080bd6e4192d717ca4a4e9334b260
TLSH
T1CA413FE05C391AD1D4FE0E6FB85729FC94EC9726F8A4343C2898E968967960E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3aec44bd442d1235d2bb80ab5e54fafe273f81017ecfa39c06804c853003fa1e
MD5 bbc491b4a91504bdd76f978f5d95dad9
SHA1 2f7e41ac9e6eef6cf5e67bf5ad28b74395ab6a5d
SHA512 63e55c11c31b4086d33b5a1d307d713de3138ea0ee139e5b0022af3a8de580429e94dccf9b3b84f219de6fffa4076f2cfe446105fa4f49938beb2c439a6d7d76
TLSH
T101413FE05C3D29D1D0FE0E6F749739FC94E89726F8A430382898E958967E60D354483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 06b6d15a0c95ee46ef55781db3b6599348bc9b81a23733c4b43d32297e3418e2
MD5 abf6a334fc8e30fe9db154a4b61a2daf
SHA1 c390eaedabc7bb7e16a9b876d975bdb19eb83d2e
SHA512 0b791dd5e87c7a0af64fd612e4b25348020c52b66f30de9a6366706234b3d4d0814c5815abbe7a13b9f88401952c7052b980ec8274e97ffe43b4e9f1054f6574
TLSH
T164412DE05C3D2AD1D4BE0E6FB45729FC94EC9726F8A434382899E968967A60D354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 21fc176072a600ef09ed88a42422d0a72f26704adcd4cd29bd4d7ab475b07520
MD5 49a134a2e4e79f77f3182843642fe85e
SHA1 ea934080d0a7daf9efe4d3da12427317b0705c7d
SHA512 e2f3f22c2209f01654d860921d096422d5b39a8378e2f32a8dca0487faa0c290509166895899d7938acc9eb988ca24ce03af95ec023fa1f409c108436a99f478
TLSH
T154413DE04C3D29D1E4FE0E6EB49739FC85E89726F8A434382899E959867A60D344483F
MD5 SHA1 SHA512 TLSH

Submit Download