d08d8cefc21783960a89cfffea6755499860559e53b0645ff5d35ecf0ba2497d

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v11K-m5-eL.svg
Size 28KB
Sample260813-1dmb5ayvbv
SHA256 d08d8cefc21783960a89cfffea6755499860559e53b0645ff5d35ecf0ba2497d
MD5 f2f7df101c9bf5d75ce49d42491e9f8c
SHA1 bfa147420c27f8f75982ba6d99be1b938f30cd3c
SHA512 85aa10c95f787a0460395f4aaaa5184eefa4b66ebfd48e0931d021752560f69fee8e79a0788d026d5c00ca8258cc558db5121631ce5c6bd0df1410ceb6c76dba
SSDEEP 384:ckwQGRNPUTQLwwizqwaowD66Uu9dqbvCK+E9xrYTxkk4sQsDI:c5QGvji
TLSH
T125D24D6437F83C9B8BCC03478D52EC68465FA8B7C498678D97C7D4E8A988368F76C560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_2089596722\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_1007854636\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_1007854636\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2116	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311303375174268"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{B0E4342D-D867-4B16-ACFE-5BE497D3CCDC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 2112	4324	iexplore.exe	89
PID 2112 wrote to memory of 3872	2112	msedge.exe	90
PID 2112 wrote to memory of 2972	2112	msedge.exe	92
PID 2112 wrote to memory of 2116	2112	msedge.exe	91
PID 2112 wrote to memory of 2972	2112	msedge.exe	92
PID 2112 wrote to memory of 2972	2112	msedge.exe	92
PID 2112 wrote to memory of 4224	2112	msedge.exe	93
PID 2112 wrote to memory of 4224	2112	msedge.exe	93
PID 2112 wrote to memory of 4052	2112	msedge.exe	95
PID 2112 wrote to memory of 4052	2112	msedge.exe	95
PID 2112 wrote to memory of 4052	2112	msedge.exe	95
PID 2112 wrote to memory of 1360	2112	msedge.exe	96
PID 2112 wrote to memory of 1360	2112	msedge.exe	96
PID 2112 wrote to memory of 1360	2112	msedge.exe	96
PID 2112 wrote to memory of 4928	2112	msedge.exe	97
PID 2112 wrote to memory of 4928	2112	msedge.exe	97
PID 2112 wrote to memory of 4928	2112	msedge.exe	97
PID 2112 wrote to memory of 476	2112	msedge.exe	98
PID 2112 wrote to memory of 476	2112	msedge.exe	98
PID 2112 wrote to memory of 476	2112	msedge.exe	98
PID 2112 wrote to memory of 1068	2112	msedge.exe	100
PID 2112 wrote to memory of 1068	2112	msedge.exe	100
PID 2112 wrote to memory of 1428	2112	msedge.exe	101
PID 2112 wrote to memory of 3064	2112	msedge.exe	102
PID 2112 wrote to memory of 1428	2112	msedge.exe	101
PID 2112 wrote to memory of 3064	2112	msedge.exe	102
PID 2112 wrote to memory of 4924	2112	msedge.exe	104
PID 2112 wrote to memory of 1084	2112	msedge.exe	105
PID 2112 wrote to memory of 1084	2112	msedge.exe	105
PID 2112 wrote to memory of 3568	2112	msedge.exe	108
PID 2112 wrote to memory of 3568	2112	msedge.exe	108
PID 2112 wrote to memory of 2836	2112	msedge.exe	110
PID 2112 wrote to memory of 5660	2112	msedge.exe	111
PID 2112 wrote to memory of 5524	2112	msedge.exe	112
PID 2112 wrote to memory of 1724	2112	msedge.exe	113
PID 2112 wrote to memory of 1724	2112	msedge.exe	113
PID 2112 wrote to memory of 5468	2112	msedge.exe	117
PID 2112 wrote to memory of 5468	2112	msedge.exe	117
PID 2112 wrote to memory of 4284	2112	msedge.exe	118
PID 2112 wrote to memory of 4972	2112	msedge.exe	119
PID 2112 wrote to memory of 4972	2112	msedge.exe	119

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v11K-m5-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v11K-m5-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffef9e1c188,0x7ffef9e1c194,0x7ffef9e1c1a0
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,5149477679518407662,11237110743235499887,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,15334334037318843075,11512336111266283280,262144 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:2
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,3082338057343863634,13507377423795988856,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:13
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,13812310165066369299,9168747290926217972,2097152 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,11836469156648732859,11623069181745919165,2097152 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,3088828469204905179,13519095514890357913,2097152 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,16310142229069321234,8117047564080437117,2097152 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
    3⤵
    PID:476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,3749217284059998681,10202340501712303726,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,10984613417785076796,11649261196039624781,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,4006126305865329604,7952391998797016732,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,15764946384204714581,12776844088510972069,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,15764946384204714581,12776844088510972069,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,1759845819915942295,10957888829601925517,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,14150620216278463531,5505769930002642268,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,6423623698518537039,14761858683097400899,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,6023667825572235302,2066255512819990611,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,4711239897437512256,2123178549607617684,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,14390184465507664711,15420628771150003136,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,3072715489536475116,5814771659530128003,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6580,i,14649787250710314107,7085595148951748827,262144 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,6299008922457754135,10181604466748558499,524288 --field-trial-handle=2136,i,4513205265023011111,15673994450297558154,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
    3⤵
    PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 920989dfdc6aa5e1d74f35527076a2198a2971b6251681fd3e0c436268382b73
MD5 8cfbadd8c96832570ad73d23c096597a
SHA1 1fe78625a4bc7adc20674212ebb18a8fb7af0947
SHA512 fadbe4427f6a821a023a2a74dd7bc949ceb11affa51b7ec072ff842d0af6576a9bc09e90b9448a64388f715467e47353e90d565b6452b72afbbf28c8ad99d9a5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T17BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ce9c3d081f4f0e468db5b15d7be2ff3643dae1380270f5599e235925c7a579ae
MD5 5ca02c197ddc80d25b0c2b83c9346ca3
SHA1 681e2b3521016203d3bf1d139e790c8d9f4ef5eb
SHA512 72eb3e3e1e2af6bdfa0ceeb1662591fc47905fbef41c800ca3807f1950e3b7da9121eadfc25d5f3f1fa6c278ba28b91ee1df0494955e054cd9e5f3550df5a162
TLSH
T1A841896F136769C7CB795DB580D294897F3CC4A945CB6E2D464021B98F8B3D89235B30
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594c61.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594c61.TMP
Size 1KB
SHA256 1d0bbb945568477eb2a2ff09ac9467ef470108f807ca872026aa8ca0e3503b09
MD5 1f87b77aa042f01f5b0fc3c7ec15fb9a
SHA1 69fae7b20c59f15425464e0a701a1448fd84f8e4
SHA512 54e7bb8619d309298ad8423badca97de0b22a80ea426cdca74970ce8aff5f027e175a99d8a9cdc313cbb3a3aff0054e5b20b2514a0514398b5bb372d44a7e840
TLSH
T1E741A96F136759C3CB795CB180D294897F3CC4A941CB6E2E464021B98F8B3D89234B30
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 453d2d8f98e6d10ffb4121565a876b59a6bc718a334d39a19c529a1aa815d119
MD5 54bf100bd141265af5a78b7411aaabf2
SHA1 12e04cd1e62f3c3da68b8b516a142399deca5f37
SHA512 30fc78cbd0d411951bb2d502547ce7033a53cb1cd91933d7288c5ccee9fc835128ce7d02caf9d91bde82d233827679f2503f8cf4d72b65c073c36bfb1dcae32a
TLSH
T14741BEF383F4857E8A0196F0AB186E1FCE2D0515432C7D5A89E4AE2B93F3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9f77d3f180ba7ca63f41b7f19f6f9782a5ea9a26d23d2c881b46cfe05fda95e1
MD5 e610390324ddb5514618cac8a30c4faf
SHA1 6e4af03cf1bb5197cf8f0be8005ac83205cbbf25
SHA512 65457e3093adeff2170043e74562287747a5b755458b2371c0a23e98c7b6ec373d4f2ac9768c26ec75c790ac3482e84a73229b31fabf1ad25d5017a9fde1f0f0
SSDEEP 192:sxR0RGiyM/jK1Ml8UQ6Co/fgsUqqZ8QubOzzoD8peK/g6+WNIYCbPsOGGMIgDpNJ:sxR0dq9o/fgsUq8DubI9/5IFy1
TLSH
T1B462D915AA649D7BCCDBD20DF681BF93D6F81573A1501E44AAFCCA1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 94f5042e27cc6b753cdd9c1ad73844ef69b31215a6cdefd4a89f053d2134f371
MD5 ce991554d1fab7f4c0a7a4b7324e5aa7
SHA1 6120153b6304611ab017728c18e1d00eb49b48e3
SHA512 dc06d3846dfeb31b0ca9e9c86eb72a551e658acb9c7968d716e236cf1ee2e9d6bb3d7bb893467af23a3901a2a5abf09b1d6ec1648e1ce0d08781b88457f2a0cd
SSDEEP 192:sxRHRGiyM/jK1Ml8wCo/fgsw/qZ8QubOzzoD8p4K/g6+WNIYCN9QOGGMIgVNJ:sxRHd8o/fgsw/8DubID/5Ixyl
TLSH
T17262E9056A74997BCCDBD20DFA917F93D6F81573A1905E44AAFCCA0C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c208fcf33888ca5a24342e303eb689fd377e6d4a384e78c524fb9ebf96343135
MD5 bc8197596faafb9f1899caa071eeecf0
SHA1 bc5567fbd27cae48782ff3dab4c46e526f55e897
SHA512 87390dc427c0b430bc3ac54f67f79776ba793158c06f2fe5af6197993e7a9a901fccdbc8d4eced7adaf0cf5bee7519b78c940943b30f0bae960b1b5f02886d01
SSDEEP 192:sxR0RGiyM/jK1Ml8wCo/fgsU/qZ8QubOzzoD8p4K/g6+WNIYCN9QOGGMIgDbNJ:sxR0d8o/fgsU/8DubID/5IxyX
TLSH
T17A62E9056A749D7BCCDBD20DF681BF93D6F81473A1905E44AAFC8A1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 95709c2173456425769e85074f61c5929d05a4a290d84c42a75a4e31fe8f828c
MD5 e63161b4f28bb8371213e6e79e14cbb5
SHA1 dbda5457acfb876f9aa0e8819e02aedce09832fe
SHA512 4c2ecc6f4d8c9ad0450b19c7f5572004a20f47f9c9c35dca2d5a063e44ab7bc25f2465bbe489a5f8fec50f25911a8213dd8a5db17533fdfdeb913c1e4138c6c6
SSDEEP 768:j/8vVPN7pLuL7tQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OViDTQqq5rovybR:j/8vVP7E7tQWgQ+fB+u1jadDTVqyG
TLSH
T1BBE2FC7B680CCB7F4F804E9DEC29BE9AADA801CF5698CD5447EA840C03C57EB56164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5b90cd28e74517b698e7022d75114595cabc14db4d7d3220d39a6f08f3eb8603
MD5 5e3a43eac688083ce64614fe695f6fb0
SHA1 a466fae671174a25c89bc9be50b2967c7b521e0d
SHA512 757349e8878494beadd7afe1c05684b42df618788542d62ec095b933687b86793f06fa4ecea6a56c33042dedfadb8158afba20559fbb5868459f25ae0e42c463
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOH0VAE+imkWivPgMkK4BgGkckEP+k5HxOf0:CbEBVj5JAdSp9/EgTK7j6dJOH0VAE+iy
TLSH
T13991F000323F02C4797DA94C8178896FCAC1B5673415E52B7BA846A64F67E439DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f9f88d357010b87cb4a7a8b4a05fa959729a2981beee8d9aea4431b0bf6bd8f3
MD5 bcf1422e184f6c35f860f509f54e5f0b
SHA1 f562071d46f9f9d7aa1803f7335e93465fa13e47
SHA512 06848533ec7428351127d14131b7f3475fc517cf3fce577be5c97a5a8beab53721e9c7a713900b3674d938883a35d5f29563ff77c8b83a0bd7dcbc96ecdd1c07
SSDEEP 768:mFQt3awgw5tNpp8+p3bd66j+4BRv86aLIW1Pi9Pmu:tt31X8+p3Z6n4y3Ptu
TLSH
T10E039E72D8A4CE2BACF6CB85B7867B47AEF401A385C45DD8E9CC5E0D148319E170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2aa7e457d7a4c32c78b8cccdd4cf9d86c7a28858d4e0a48ad65230b93b33abfd
MD5 bdf106d7e8623bc24e8097d665ca78e1
SHA1 05992c8bc66e115a1e237712ba75831402149a94
SHA512 8c2c4563a8eedba0f7a03340c17c34f36f6f3f7b6ee5ffa28f5724380ed8bd8d8d7cdcbcf5811810b0a2158e8d061a93255d11f3f5e5515f076434f10b4c9cf7
SSDEEP 768:+r3tC8Nmzp8+p3bd66j+4BRv86aLIW1Pi9Pmu:+r3/mF8+p3Z6n4y3Ptu
TLSH
T1F8F2AF71E8A89D679CF5D744B29637836FF851A3A5C01ED8D8DCAB0D188325E170B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 66a0e2ae906e3ad52c25b4f36734a75c495911895125e7759adf039be37eff5f
MD5 473b468e9d3ba1ce76b2dafba2ec0583
SHA1 22e6ea31a0125bd8b5d5a69d5f16f5fd1629e47e
SHA512 67b151f0145aa24bd07e39ef778a05f9f32aa246f00316626b17a70fc62e678b5b8be6d1f3b7b8578817480e56784c2192aa0087c8230ae04b2c2b2d304ed756
SSDEEP 768:Tr3gC8Nmzp8+p3bd66j+4BRv86aLIW1Pi9Pmu:Tr3EmF8+p3Z6n4y3Ptu
TLSH
T18AF2AF71E8A89D679CF5D744B29637836FF851A3A5C01ED8D8DCAB0D188325E170B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9c79238fa832edfe6cd47bc40f4dd7e0ac71beb3309a8774aa176dd673f5393a
MD5 0b04934f7a94c2a5e3228dc6a64f9574
SHA1 7b123c5e90f6e7f699195d75140077b86aae5c5b
SHA512 bf7a4af621eb66e15b19c24907f26e9eb4833d79598ecc311892caadceef91e35694e2821703652611f025b9eb2540980a6ff92dbb6613d5e965af159fd612ab
SSDEEP 768:Irv+4UNbdD3vc8LNp8+p3bd66j+4BRv86aLIiH2bwCl1:Ibsbp39L8+p3Z6n4yB0ww
TLSH
T17A03BE72E9A899739CF6C644B2467B433FF851A396C10AC4D4DD2B4E419A19E230BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 0e69ad6e7a28ed1acb445c6c6738e008edc28c84e9e2929b23ebf5bf543d225a
MD5 459de2d47567c39fed686d68d9c12251
SHA1 a4b5b29fe603c9296a098398f6a00f67eccb97cf
SHA512 dbc73f06dda0ecac412a4af69189dfc971f4a076dd253edb30a8664e3af6cefa218a28052bcdffb986f57a6b7eaec632ecf303c6a5ca1bb7661712f216545e38
SSDEEP 768:9rv+4UNbdY3WC8Nmzp8+p3bd66j+4BRv86aLIW1Pi9Pml:9bsby3SmF8+p3Z6n4y3Ptl
TLSH
T11513AE71F4AC9D739CF6C644B2872B837FB811A395C10ED8E8D86B4D498619E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c9cb4435f07988bdc08205922eac947718fbe6b49455086c774ff1dfe7dc1526
MD5 1c6e11f752bcfc4824eb1de1a5433178
SHA1 637a7a1eb56d4ca82906abba15bf60568921ed65
SHA512 ed1380a81d77449a05a71282ca55dda4bcb5ad14a58e78dfa5d5ffbffa510b3e9ea263f1abf8f69865ed38ab3dfee4f677251a8a7580c6568427e23f483f8de1
SSDEEP 768:brv+4UNbdD3Iw8NmNp8+p3bd66j+4BRv86aLIT12bwCl1:bbsbp3CmL8+p3Z6n4yk0ww
TLSH
T1FA03BE72E4A89D339DF6C644B1867B837FF811A399C10ED4E8D92B4E445629E370F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

b461baad-d78c-4c79-8f5e-17eb895776fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b461baad-d78c-4c79-8f5e-17eb895776fc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2112_1501112244\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download