691bebdb70a39edb56c9a4573b009c8feecbcaca5b438cd4e5454b351b4c5f91

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v18R-m4-eM.svg
Size 57KB
Sample260814-s8stdsej51
SHA256 691bebdb70a39edb56c9a4573b009c8feecbcaca5b438cd4e5454b351b4c5f91
MD5 8b9081c1b97a4eac196685a1f8617477
SHA1 89a34da98763f220cbdfc9dfaff9157a8239af61
SHA512 de72e780093390de1e184eb1cd1f29908fa6e5e100cf49a698ae67d4561ee17ba3e1af4f1a74237a4ed5ef14589791d4ed0e522e662faf2e00a580e1f299cbd3
SSDEEP 384:cgSrmXAixJODd7YkfwjGHDBPBsuQnPY7Yast17SXRargsZGmDLYjUpdMp9oDrUvP:cKXl4sZTDK9oDO
TLSH
T11243737637F4BC9B8BCC034B5D02EC6C45AF94B784A8668C9BD790E89548368F7EC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1737522076\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_10682479\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_10682479\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2452	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311960984231682"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{EA58A92F-0C3C-4EE7-8C4F-7C601C010DAD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5764	msedge.exe
5764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4704	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 4704	4132	iexplore.exe	89
PID 4704 wrote to memory of 4196	4704	msedge.exe	90
PID 4704 wrote to memory of 3844	4704	msedge.exe	91
PID 4704 wrote to memory of 2452	4704	msedge.exe	92
PID 4704 wrote to memory of 3844	4704	msedge.exe	91
PID 4704 wrote to memory of 3844	4704	msedge.exe	91
PID 4704 wrote to memory of 2928	4704	msedge.exe	93
PID 4704 wrote to memory of 2928	4704	msedge.exe	93
PID 4704 wrote to memory of 2448	4704	msedge.exe	95
PID 4704 wrote to memory of 2448	4704	msedge.exe	95
PID 4704 wrote to memory of 1692	4704	msedge.exe	96
PID 4704 wrote to memory of 2448	4704	msedge.exe	95
PID 4704 wrote to memory of 1692	4704	msedge.exe	96
PID 4704 wrote to memory of 1692	4704	msedge.exe	96
PID 4704 wrote to memory of 4664	4704	msedge.exe	97
PID 4704 wrote to memory of 1508	4704	msedge.exe	98
PID 4704 wrote to memory of 4664	4704	msedge.exe	97
PID 4704 wrote to memory of 4664	4704	msedge.exe	97
PID 4704 wrote to memory of 1508	4704	msedge.exe	98
PID 4704 wrote to memory of 1508	4704	msedge.exe	98
PID 4704 wrote to memory of 3636	4704	msedge.exe	99
PID 4704 wrote to memory of 3636	4704	msedge.exe	99
PID 4704 wrote to memory of 2760	4704	msedge.exe	101
PID 4704 wrote to memory of 1836	4704	msedge.exe	102
PID 4704 wrote to memory of 2760	4704	msedge.exe	101
PID 4704 wrote to memory of 1836	4704	msedge.exe	102
PID 4704 wrote to memory of 5620	4704	msedge.exe	104
PID 4704 wrote to memory of 1528	4704	msedge.exe	105
PID 4704 wrote to memory of 1528	4704	msedge.exe	105
PID 4704 wrote to memory of 5584	4704	msedge.exe	107
PID 4704 wrote to memory of 5584	4704	msedge.exe	107
PID 4704 wrote to memory of 1660	4704	msedge.exe	110
PID 4704 wrote to memory of 4368	4704	msedge.exe	111
PID 4704 wrote to memory of 5588	4704	msedge.exe	112
PID 4704 wrote to memory of 3644	4704	msedge.exe	113
PID 4704 wrote to memory of 3644	4704	msedge.exe	113
PID 4704 wrote to memory of 4828	4704	msedge.exe	117
PID 4704 wrote to memory of 4828	4704	msedge.exe	117
PID 4704 wrote to memory of 5764	4704	msedge.exe	118
PID 4704 wrote to memory of 3724	4704	msedge.exe	119
PID 4704 wrote to memory of 3724	4704	msedge.exe	119

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v18R-m4-eM.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v18R-m4-eM.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe994ac188,0x7ffe994ac194,0x7ffe994ac1a0
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,3188305289506341801,2517287287206471803,262144 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,13035653479716313942,5004442767599826017,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,10072589290118380430,4711494415726514162,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:13
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,773831903214189378,4684879826409127091,2097152 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,9123970570270860472,3106602240247839980,2097152 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,16890798409313881046,3982737772751193046,2097152 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,4561576510077056762,10816929068708031209,2097152 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,2746262907556665299,15793170357340344111,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,6293708418718796546,9687681719942446474,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,9555557605711732446,13332182515235511301,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,5013546198911034733,10639382112414426333,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,5013546198911034733,10639382112414426333,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,13464454952639823217,3650610378903567642,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,4810611807464841664,16365539713740969092,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,5297150857861386346,13802605251697674251,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:14
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,11989242850957371437,14811037643660525080,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,18228588615640651288,6093996127560084108,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,18319970691085543331,10467149426153650676,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:14
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,16437984779897156972,2434737283976636356,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5420,i,18025664308402510263,18203188750383752458,262144 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,3515789797796143418,6280445684571716570,524288 --field-trial-handle=2120,i,17535423942419373719,2963166661048400845,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:14
    3⤵
    PID:3724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 7f1fadc520ea0c84cc72919b7cf8d7726472e4ce3574a3568e709b118988493c
MD5 13c3e1772a5aabb50b923e6eca823633
SHA1 5a3dfed08dc7c84350f5d0c6237e8a854676b917
SHA512 f000d2e42960b84b6799e07728a562adea8b5e74f0a08c84876de7ecd4854a7ae0f008380151e811e37cff4c6ecd41277c80f8f390bc00d5682908c2de2c79b4
TLSH
T1C421EB6903281ED3DFA555B2AFD2466E32F9AC6F12C72F901C41AD30ADF1F9450D1443
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595990.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595990.TMP
Size 1KB
SHA256 546b60623cca560d04f186d3d2cee8c7942d5d0accd3c0337e72e63106489abb
MD5 495c2aec1273d429c53111716a9194a7
SHA1 252fadc49798dcb6c8310ce655d71279eb5964a8
SHA512 2c71ab95f2686f6d5749e41b6e39d7568ae1a156eaaf93f5ec7dcce869a55abaddb2348161dfd0a1f88257d53c3b463ed2b4d30e4a5c74d991a1f6e537568036
TLSH
T13C210D6807281ED3DFA155B2AFD1466E32F8ACAF02C72F900C45AD30ADF1F9460D1043
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8d80c753ca85eb7ee092cc078e6e48ac821d624694415b1bf31008e12601e6a9
MD5 51625f6ff302f9b78ba8d61b897a519a
SHA1 6b87bedf41a36e99f28115eb1b1dcd5dc5facf92
SHA512 cb0a111d6f7feab6b2eeb9c5abcdaf8598fdd3a1ae96a143b2b3dc2309457921cfa1df525b52dc50955956f6a31a831d323d59524c3c528dd084d364adb68549
TLSH
T1D941BDF7C3F4857E890196F0AA146E1BCE2D0951432C7C5AC9E4AE2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d9c3404dd79ad0f6b7c89c548988f93667642da7bb3e94d84b50652d20b3b5e6
MD5 79cf47e99ff3df0655b0800384fad55d
SHA1 8014b0db4009c176e8d882e8cbf272fe58a6be74
SHA512 22bc3726beb0257628852600286d02b716396bf53b4a1861eebc20084717d7fcb28bf5294298fdf8fa8fc7c1d55941c869bd5c3786d4e7fdb4c24293833574e8
SSDEEP 192:sxRK6R6yM/jK1Ml8wCE/fGsVzWBZgMquozoD8p49/g6+WNIYGlbcrQGzIgVYJ:sxRn48E/fGsVzWPvqu4g/5IwXS
TLSH
T11A62F9156A346977CCDBD20DFA527F53D3F91473A1905E44AAFC8A0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c6442e646ca34c45a80b87a747a60686a2f8eaf79ebc430ab62682ba4a44f0b6
MD5 b2e3dbd87be5c75d1bf131ec30618609
SHA1 7e16eb194214420c8848b5731e7e992e5bb40011
SHA512 cba0c5c7fd7b844400a36ab4aac38f96b66aca35e500f9e3588e7aceb3975254bb7dd1d28580cdaa6bea719a46f5f454ac2631b76b997106dbefbe55dcb5a37c
SSDEEP 192:sxR56R6yM/jK1Ml8UQvCE/fGsLz+BZgMquozoD8pe9/g6+WNIYGxoHQGzIgD8YJ:sxR04q6E/fGsLz+Pvqu4e/5I0XJ
TLSH
T1D762E815AA346977CCDBE209FA517F53D3F91473A1905E44AAFC8A0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8883a2cd44a56e78ff14e652e375f3287c1623a07e10bdef761fdb312c714d0f
MD5 f5d778b556ee5860458dccdc4326d3cc
SHA1 2f325968b1760c53ea4a876cc237aa72e786efdd
SHA512 e475ff4f695d4f42bd9ba9295d5d32074124a0a3e862cb9d6c97154bbac87366f962b9597f39d4f42997869d295c6a88c44d247d4fe1a1af46f97292be8e36d1
SSDEEP 192:sxR56R6yM/jK1Ml8wCE/fGsLzWBZgMquozoD8p49/g6+WNIYGlbcrQGzIgDGYJ:sxR048E/fGsLzWPvqu4g/5IwXz
TLSH
T15262E815AA346977CCDBD209FA517F93D3F91473A1905E44AAFC8A0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ed18c8d49c9bd81170133a43a1a0f7096f684f66d08af196ebe7af5cec072eed
MD5 387e45492f8ff1c0eb4dc9d0b7037313
SHA1 a37d7ff1fe236cb79004457ca91bcce10af0cc22
SHA512 e165c12e1cbd236a96551b5b5726b8b6a6a3f50c8ac0be385b3e9d720b2b81de3761ac80e09e72c715cc5839f4da3b939e8257aa88d0ab4c7b6d1eba614f1738
SSDEEP 768:UtiiL37pLuL7ANWgv7fgJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJAepN0LroY2e:UtiiLxE7ANWgv7fgJu1jaKAef04be
TLSH
T169E20C3B680CCB7E4F804A9CEC29BD9E6DE801CB56D8CD9447EA481C03C67EB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ca076b501894a65fea5df0f5f5f3ffbb4b6989d7f2a916c051fb666b2c9aaff5
MD5 adc7564cb733387fb19ea1dfd59438c7
SHA1 cf56df9822fabc74f18813471cfab1700d568043
SHA512 8755ab8a76d0ab6970004cd090f6b0c120604f45d2cf6ec55a562b94522274326e03c5f8ca69317363e9158eb63d6c7462efb506d3225a057ed315cee91ac071
SSDEEP 192:Cm7KmgIIJ4tWGm7g09OGlkEfEIEtEpEfEdE9EcEJEmEtERE7E4gE/EeEnEvEOERg:MUg1m
TLSH
T1DFD13845753F0290397EAA0891B98C2F92C174A7306CE46B7BA911751F6BF03ADFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

661158b6-05f9-4923-a1c3-97676f3c26f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\661158b6-05f9-4923-a1c3-97676f3c26f5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4fcee3bbacbc78117b8d9ce85486f4b347c1105ccc0fc0a2623d2ba4fc262d5b
MD5 a98d0b69eae27676a2fbfd98a195f273
SHA1 bea25cdeaa4fb91806e36bff67778dafe97ead6e
SHA512 e0ffd9ef1f7d8722fe479d64959a843a777f732013b77c60d034465cc8dd896936f7a24a8a3b26e1908b66748b591b9c09708b0ce1ffba56b36553bf7aafcbcd
SSDEEP 768:cFQY33wg2uhCzl3ExIj7Hucys6BRvi82oP4/z6himo6DPi9PbM:PY34oxIK3imOz6ImoUPP
TLSH
T16C039E71E884CE77ECEBD7C5E54A3742AFF01263C8C89994E6D9DA0D15836AD070BC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5fce9ca65da2d27e8ef01df65797c39b91493e567e96f2241dd32a114e9438f7
MD5 e4e84b29f13fc6eb7a782dced1fa3738
SHA1 84cc5c222bf25a32bf7d92010b83fa04df41504e
SHA512 3c12806be19efe98d18a1af742d18db59507f46facf44c7ae5029509864b417c1b2a3cb8c6a93f74d83b8d11919850f80c99db6f83c202b1a8e4dcb7f3e10272
SSDEEP 768:M/3OuhlYy7xIL7Hucys6BRvi82oP4/z6himo6DPi9PbM:M/3OExIi3imOz6ImoUPP
TLSH
T150F2BF70A8559D229CEBD285B5863B937FF4223395C85D94E6E9DB0D09C3B6E070B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 caed0c41a16f1d95741e17e84126c7c0959a839728f58b75562bb64f7489b92a
MD5 19f0e8a3925d903e7a4737396db230a2
SHA1 691f02bf25931fdb67c01ef2d0a3d48f36fc3a2d
SHA512 0e5d154aa8cbaa4e09a2a7108adc5d3e7da922eb310edc5ad6c081423ef260859bc661e6c1321fbd357f30021efdb2f37c2b3da1a62dd0010b4dacd65f870aca
SSDEEP 768:6/3pnhlYy7xIL7Hucys6BRvi82oP4/z6himo6DPi9PbM:6/3pdxIi3imOz6ImoUPP
TLSH
T18BF2BF70E8558D229CEFD285B5863B837FF4223395C85D94E6E9DB0D09C3B6E070B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fd1327fafe72604c46e75edd29c44a986f56a5511f2decb8ad61b4e14026aa8a
MD5 a2e0c59ee04a9887a24f0f8c9190a389
SHA1 a52e5702820300bccfe3cbce35138e3d8217961a
SHA512 b978eb9f6948f6ae656f666fb5afb0c23c435e87e2f998178df4874864acf6ad36052122d355b08b3f28b226f664157c7a45bf91c8e60eceea23da220935ef50
SSDEEP 768:xGrv+4UNbdS38fPlYy7x87Hucys6BRvi82oP4/z6himo+e2bwn+h:xGbsbw38/x53imOz6Imod0w+
TLSH
T12103C035F4549972DDEBC188B44A7A633FF4522345C91AC0E6DE6F0E029BA5E630BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a84e35dd9cb71f7bddc15fd7ab88aa0202848a530686f87905c0896e1f01c887
MD5 002194f69079cfa56910becfc08f824c
SHA1 bb638f5bf81e6ca058b887028dbd97e4d78d384d
SHA512 80a2c78cd0e75bf2738780cf9f4819db1a7f3fe05ef2266c7e0a1b11c0040ed859bf4ad6b5c0b0c91c942efca7bd561e00f815a93d4687e8a34288485925fbea
SSDEEP 768:arv+4UNbdS3+nlYy7xIh7Hucys6BRvi82oP4/z6himofD2bwn+h:absbw3ixIA3imOz6ImoL0w+
TLSH
T19A03B031E4199D32DDEBD184B046BA937FF4226349C95E80E6DA9B4E0587A5E230FC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

5c4cd040-7c9a-4ccd-9eb7-729b9a14c048.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5c4cd040-7c9a-4ccd-9eb7-729b9a14c048.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4704_2017656332\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5620-194-0x00000259B8500000-0x00000259B865F000-memory.dmp

Download

memory/5620-195-0x00000259B8500000-0x00000259B865F000-memory.dmp

Download