691bebdb70a39edb56c9a4573b009c8feecbcaca5b438cd4e5454b351b4c5f91

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v18R-m4-eM.svg
Size 57KB
Sample260814-ss3nnaae65
SHA256 691bebdb70a39edb56c9a4573b009c8feecbcaca5b438cd4e5454b351b4c5f91
MD5 8b9081c1b97a4eac196685a1f8617477
SHA1 89a34da98763f220cbdfc9dfaff9157a8239af61
SHA512 de72e780093390de1e184eb1cd1f29908fa6e5e100cf49a698ae67d4561ee17ba3e1af4f1a74237a4ed5ef14589791d4ed0e522e662faf2e00a580e1f299cbd3
SSDEEP 384:cgSrmXAixJODd7YkfwjGHDBPBsuQnPY7Yast17SXRargsZGmDLYjUpdMp9oDrUvP:cKXl4sZTDK9oDO
TLSH
T11243737637F4BC9B8BCC034B5D02EC6C45AF94B784A8668C9BD790E89548368F7EC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5948_91258872\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5948_295108863\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5948_295108863\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3208	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311946602096352"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{2801F802-8A3C-4720-9649-E101D2C9B920}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5948	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 5948	1968	iexplore.exe	88
PID 5948 wrote to memory of 5864	5948	msedge.exe	89
PID 5948 wrote to memory of 3208	5948	msedge.exe	90
PID 5948 wrote to memory of 300	5948	msedge.exe	91
PID 5948 wrote to memory of 5232	5948	msedge.exe	92
PID 5948 wrote to memory of 300	5948	msedge.exe	91
PID 5948 wrote to memory of 300	5948	msedge.exe	91
PID 5948 wrote to memory of 5232	5948	msedge.exe	92
PID 5948 wrote to memory of 4172	5948	msedge.exe	95
PID 5948 wrote to memory of 4172	5948	msedge.exe	95
PID 5948 wrote to memory of 4172	5948	msedge.exe	95
PID 5948 wrote to memory of 5012	5948	msedge.exe	94
PID 5948 wrote to memory of 5012	5948	msedge.exe	94
PID 5948 wrote to memory of 5012	5948	msedge.exe	94
PID 5948 wrote to memory of 2732	5948	msedge.exe	96
PID 5948 wrote to memory of 2120	5948	msedge.exe	97
PID 5948 wrote to memory of 2732	5948	msedge.exe	96
PID 5948 wrote to memory of 2732	5948	msedge.exe	96
PID 5948 wrote to memory of 2120	5948	msedge.exe	97
PID 5948 wrote to memory of 2120	5948	msedge.exe	97
PID 5948 wrote to memory of 3320	5948	msedge.exe	98
PID 5948 wrote to memory of 3320	5948	msedge.exe	98
PID 5948 wrote to memory of 5072	5948	msedge.exe	100
PID 5948 wrote to memory of 1880	5948	msedge.exe	101
PID 5948 wrote to memory of 5072	5948	msedge.exe	100
PID 5948 wrote to memory of 1880	5948	msedge.exe	101
PID 5948 wrote to memory of 864	5948	msedge.exe	103
PID 5948 wrote to memory of 2664	5948	msedge.exe	104
PID 5948 wrote to memory of 2664	5948	msedge.exe	104
PID 5948 wrote to memory of 1820	5948	msedge.exe	105
PID 5948 wrote to memory of 1820	5948	msedge.exe	105
PID 5948 wrote to memory of 3612	5948	msedge.exe	110
PID 5948 wrote to memory of 1180	5948	msedge.exe	111
PID 5948 wrote to memory of 1284	5948	msedge.exe	112
PID 5948 wrote to memory of 264	5948	msedge.exe	113
PID 5948 wrote to memory of 264	5948	msedge.exe	113
PID 5948 wrote to memory of 1716	5948	msedge.exe	117
PID 5948 wrote to memory of 1716	5948	msedge.exe	117
PID 5948 wrote to memory of 2256	5948	msedge.exe	118
PID 5948 wrote to memory of 1376	5948	msedge.exe	119
PID 5948 wrote to memory of 1376	5948	msedge.exe	119

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v18R-m4-eM.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v18R-m4-eM.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x368,0x7ffb09ddc188,0x7ffb09ddc194,0x7ffb09ddc1a0
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,14340407192896691578,5870239970952061605,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,5568357513668458881,3478073776198820878,262144 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
    3⤵
    PID:300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,141167394194873667,5683643387315620015,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10723456640978436042,4873811409984547111,2097152 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,14899353403371774634,14028590985984743903,2097152 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,2427591117779686612,6240448509435806214,2097152 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,4355659885308299026,2452658775012636105,2097152 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,13260995630803803340,12315474586056107095,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,7391161744586330629,15563497842109629953,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,14943613305517792590,2718863743600806825,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2327802958686190017,400258642913367145,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2327802958686190017,400258642913367145,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
    3⤵
    PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,17679510310052934907,10572087208959120709,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,12238445998266779472,3054165300537229705,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,16805057327200656017,16909358819034772248,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:14
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,4063287272525666351,8618399654483008998,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,9950543961398483054,1007242253344770649,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,5172102836836201872,5611023763748373304,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
    3⤵
    PID:264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,6768648880442872902,3991792134423550106,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5308,i,11550228662687506392,9374030882947441067,262144 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,11841873033947605297,7407511053055252180,524288 --field-trial-handle=2360,i,9490707186550197278,3871395653544624864,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:1376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e0424f12e2966d4edd61d48eb03e7a78e7aa9d384165acd4a8973fc664dca54a
MD5 7acb47b9e36d0b80e2fc9707e9c8e89d
SHA1 551a4ce1b41fc63afca9012e67ab4229c732feb7
SHA512 9b137ab83de648a2382112e33229e3ec6225fb81e794374fa123d6e7e13e4de7bc9858a11d08d360a0f72c10415e71a0f49f1cffe9e27deeea1ca3cbacdcc9b3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7K:fwUQC5VwBIiElEd2K57P7K
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1d5fdff47017124dc3fb79352cb7f5095ca7858769b31a53abfcdb617b88dce8
MD5 6a761042ba47da5f6c0bef6b67a5ea75
SHA1 f4b3c9ae3846ec568f91d530b5fe7993de8872f2
SHA512 a545f6a7eb1ae3072e1b5c7d23f15ac963972279a25cc9e03b3cb4d102f148eb5f004637f9caf7666dc7a7c4672a9fcc8c2c7da0ca82c0251c092b7cf0a4f695
TLSH
T127612D6173603DD2EB268AB621FB688971F68C5D3307AB79A380BD759447F8810D21D3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1f55715b600e9598188fa462c32e1a4a1a430732bef5d5ad6958499536aed79c
MD5 26b2ed76098c63c0d606e289ef2baed6
SHA1 941c741b9099abf40db840e19ab6799a4216568b
SHA512 e25a54101e05baf4f7f304cded84ebd1a3e720350afd6f3026d8127c149ba978d69b1e7a517d80e45ef0c823a2e960add03d708bd2947f562b5cf93555a5b778
TLSH
T1AF419EF383F4D57E8A0156F0AA186E1BCE2D0515432C7D5AC9E4AF2793E3471E142A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 eb47f9861c632e76d5881ab075c8d520c8d69f2451b6c5e6de98c6c4a8f2ba24
MD5 9e480b019a5a861b507559e541b7548b
SHA1 7d92ba9d5949d59afbd1cd9dc8512687cc1c0e2d
SHA512 0bb34de6502b77ab7b014f9f717a112c602366ff5166f1c9e238f871c9cd72bd4e0caaf7632c2081ab40a8bc17ddb03e75bd0353a8dcded9035409c906c2a5ef
SSDEEP 192:sxRDRwyM/jK1Ml8wCm/fcsj7IZT9zoA8p44/g6+WNIYEgSL/GNNIgVfJ:sxRDa8m/fcsj72TwN/5InKn
TLSH
T19362F9056A24A977CCDBD20DFA557F63D6F81573A1901E44AEFCCA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fe3d8906e4592dd4e6732cdfbea03087321f8994a084db4c6f248bbb7217deb7
MD5 066f620c9a8c82085efa12b1ce1a4af3
SHA1 4504a4e67e981736a5cf793fdd7dbdc85a520053
SHA512 b2aaceacce5a5f0cf74e17099619e0d4493bace8e697393f0a920af5675e9a074f736fbba333423e8733b2c6ff9456cb0e47baad80b62c4ec87d668cf9edb0d7
SSDEEP 192:sxR4RwyM/jK1Ml8UQXCm/fcspGIZT9zoA8pe4/g6+WNIYEdUs/GNNIgDFfJ:sxR4aqSm/fcspG2Tw3/5ITK7
TLSH
T1A762E815AA249977CCDBE209FA557F53D3F81473A1901E44AEFCCA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ad452ba722412fc0bf0a2db05c3389c9a76de0a549a424d3893c7f46f6442b24
MD5 221e5ef60e6aa6a6b956b14a18080d7f
SHA1 139d026252d218fc3f58d7ec96d4dc47cd0f407c
SHA512 454bd822fbf9a82c480455ee7f303aa98a570c848a010b6a4b26c1c93d2dfa8db2feb0ad5c817d4cafa3980c96954fe6eb07eadbee63d1d195124660c5eaf502
SSDEEP 192:sxR4RwyM/jK1Ml8wCm/fcsp7IZT9zoA8p44/g6+WNIYEgSL/GNNIgDHfJ:sxR4a8m/fcsp72TwN/5InKF
TLSH
T10062E815AA24A977CCDBD209FB457F53D6F81473A1901E44AEFCCA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 be720adca36b98d7bb92a528cbb7b2b2141c184d820f84f72527feb092075a3f
MD5 28b178976431b1050039257bc519217e
SHA1 0c592f52d71d7d1f0549c8147a380206ef78045e
SHA512 27155039378e5288e064beba663127941fa7f9d47436e2334cdc138b2a28670319674405a4a61024b49088cf98031b216c24237b11638127a4dd7f1d361b0f0e
SSDEEP 768:40D76DrQD83F7pLuL7J0DbWgQ6DjfPQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFD:40D76DrQD83TE7J0DbWgQ6DjfPQDFu1T
TLSH
T11CE2EC3B680CCB7F4F8049DCAD29BDCA6DE801CB56D8899447EA881C03C67EF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a13098c5d2d2dd4dfef09003f1ad0ba8449c2ea598671db46a52c3726cff8e56
MD5 3fdae947e1f798f436a857ddd7754164
SHA1 949e2791145a47d6c52823474e77986195fc6df7
SHA512 e620180098221c479377b8658e70d5f2091d572bbf699d4ecfba59ab576d61181aebcac6d91c57b004a88a77be51fe78cc4a68548a7d0510730ab6440034039d
SSDEEP 96:KRyX+SkE0SWcJhgCSK4Xg4ScCqRwSbHeTieYgQGWAltgeGK4DgcGcW+9M9tqKGAN:CyX+SkE0tcJCCqXg4ZCqRwSbHeTieYgf
TLSH
T1B091715434FA42603DBF6A1C817DCD2A4692B0A73218E93B77AC85931F67E064DFC8C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 9fc0973eabf05b7d5064809a292af946272bf4f57b27a3690fb57650f5397923
MD5 e7360b5b760e022ea449fcba99336a01
SHA1 753de588d6f93fd8a85a164cc96b61946253d012
SHA512 90c9f0fa01790610306b465ed499a369b1faea1a5cabdf20222fcb172ebfca8ef1788c4666be0d2a6a2409d02279428c9286a80cd540b818dff32457b8bb68c7
SSDEEP 768:y63nvBFnZ/oImeX6+qTko0u229a4vsTbPi9Pki:y63n5TvVTVKa4yPK
TLSH
T1BC038D70F875DE6358E6D38173167A87AEF411B3C6C85DC4D9EDAE0C048729E1B0B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 56c57381065112f095ba55a40d48a83fa07e90104a8a20ba47d463f3be30bde6
MD5 b3e73ba1e56184a8fbe6fa0132d60072
SHA1 f9f9c295487dc1c0996e904f176b7819390f69d2
SHA512 a44515c9ccf67f8cc2a770161ba6829b60bbce164025abe408c2d10892e6a64c1345b4a2c1d4cc5f34f7fd5fafea9e10abcd174e0d0b0e93645b284300bd7464
SSDEEP 768:uB3nvBGDTd+Z/oIMeX6+qTko0u229a4vsTbPi9Pki:uB3ndVvVTVKa4yPK
TLSH
T13FF2BF70F8759D634CEAD784B35636476EF920B3D6C41E4499EDEB0C094725D1B0B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0dd7c661a47a7d5970a44d750fbd89bdb57976307bc437f2f9954fa2049869a9
MD5 5125051096791c5d46addff38574b174
SHA1 8ea58942efda23a368b283e901d76def421666a3
SHA512 8a22e492f6e9781132572247e0f2c5afd127b16b29e91a11932168175c307a940fe6fc8aadad294b913d9a9c2aa4cedd11be8194af60219450e4d0291b0430db
SSDEEP 768:prv+4UNbdG3xdIDTd+Z/ZeX6+qTko0u229a4vsD1eVH1SdW:pbsbU3ZQvVTVKa4AEH1h
TLSH
T1C603CF32E8B98A778DE6D784714B35473EB95163C6C80B80D9ED6F0D065B59C230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 83a0b45efeab405f418c5807a1756f2fda5f3e357d25a09b186b4a0270991333
MD5 88340438b642c71f2acbd69703e3683e
SHA1 2cd801a9cb3e107cd4632d891212689513600e88
SHA512 ff5331e1ac51b2e902ea564cdd84e365a4209cae8a3cc3a8c00c48a3bc3f0d34b844f356318315a1d6e8ad4929928560e4698c232023f44b714b8d940b220d33
SSDEEP 768:KB3UvMGDTd+Z/oIMeX6+qTko0u229a4vsTbPi9Pki:KB3USVvVTVKa4yPK
TLSH
T1DAF2BF70F8759D634CEAD784B35636876EB920B3E6C41E44A9EDEB0C094725D1B0B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 a33404d61ae96d00a397c88023455d82facfec60f1ea92f1139252458f906880
MD5 af7271eeb20ebbcfe656aa86b4cf1a4d
SHA1 5c68109876114cdf0dd00b03cb53e7b5762eac54
SHA512 00b0a1b607af5dccc74ce3c182e2d7783567628c8f730bd5fb6b7b757f6d9cfb5702db998448f377d70bdc460ee553e987f31601a4b18b8b95dbe95584fa9e3e
SSDEEP 768:Urv+4UNbdG3NUkDTd+Z/oIWeX6+qTko0u229a4vsSbeVH1SdW:UbsbU3uDvVTVKa41EH1h
TLSH
T14303BE31E4699A734DE6D284714B76873FB921B3C6840F84D8EEAF4D064B59C270F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

752f896b-80ae-4da8-b498-6a46ff62c70e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\752f896b-80ae-4da8-b498-6a46ff62c70e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5948_245097117\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download