61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v17Q-m3-eL.svg
Size 51KB
Sample260815-e795dsyfrc
SHA256 61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e
MD5 fc198985be568c9448dca602f675d2a3
SHA1 acbab1f92a29f89b0c5551fa1c0437ac00739166
SHA512 cae28fd45619470e736d8cbf3586ace8188529cef1810bc1ba52167d16598313952df7669561a535411372356128239006cc9e323d1d9dc0220c1398d77395e4
SSDEEP 384:cmB+3n8fSEBJc1K04m3VQvtvOXmcInOD4WhU62qlOcM933g2G44AJ8pnoSfWcfGY:cNelTKpozCfF
TLSH
T1283380A637F47C9B8BCC034F5D02EC6C45AF94B78498668C9BD790E8A548368F7EC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_2042597987\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_92314800\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_92314800\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4552	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312421781006698"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{F74BB779-E650-4FF3-8E53-25E971CDA691}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5192	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 5192	920	iexplore.exe	89
PID 5192 wrote to memory of 2592	5192	msedge.exe	90
PID 5192 wrote to memory of 2560	5192	msedge.exe	91
PID 5192 wrote to memory of 4552	5192	msedge.exe	92
PID 5192 wrote to memory of 2560	5192	msedge.exe	91
PID 5192 wrote to memory of 2560	5192	msedge.exe	91
PID 5192 wrote to memory of 2748	5192	msedge.exe	94
PID 5192 wrote to memory of 2748	5192	msedge.exe	94
PID 5192 wrote to memory of 3680	5192	msedge.exe	95
PID 5192 wrote to memory of 3680	5192	msedge.exe	95
PID 5192 wrote to memory of 3680	5192	msedge.exe	95
PID 5192 wrote to memory of 4172	5192	msedge.exe	96
PID 5192 wrote to memory of 4172	5192	msedge.exe	96
PID 5192 wrote to memory of 4172	5192	msedge.exe	96
PID 5192 wrote to memory of 3184	5192	msedge.exe	97
PID 5192 wrote to memory of 3184	5192	msedge.exe	97
PID 5192 wrote to memory of 3184	5192	msedge.exe	97
PID 5192 wrote to memory of 5068	5192	msedge.exe	98
PID 5192 wrote to memory of 5068	5192	msedge.exe	98
PID 5192 wrote to memory of 5068	5192	msedge.exe	98
PID 5192 wrote to memory of 4928	5192	msedge.exe	100
PID 5192 wrote to memory of 4928	5192	msedge.exe	100
PID 5192 wrote to memory of 5780	5192	msedge.exe	101
PID 5192 wrote to memory of 1896	5192	msedge.exe	102
PID 5192 wrote to memory of 5780	5192	msedge.exe	101
PID 5192 wrote to memory of 1896	5192	msedge.exe	102
PID 5192 wrote to memory of 2328	5192	msedge.exe	104
PID 5192 wrote to memory of 1100	5192	msedge.exe	105
PID 5192 wrote to memory of 1100	5192	msedge.exe	105
PID 5192 wrote to memory of 1368	5192	msedge.exe	106
PID 5192 wrote to memory of 1368	5192	msedge.exe	106
PID 5192 wrote to memory of 4920	5192	msedge.exe	110
PID 5192 wrote to memory of 2912	5192	msedge.exe	111
PID 5192 wrote to memory of 4800	5192	msedge.exe	112
PID 5192 wrote to memory of 5164	5192	msedge.exe	113
PID 5192 wrote to memory of 5164	5192	msedge.exe	113
PID 5192 wrote to memory of 3048	5192	msedge.exe	117
PID 5192 wrote to memory of 3048	5192	msedge.exe	117
PID 5192 wrote to memory of 4692	5192	msedge.exe	118
PID 5192 wrote to memory of 5272	5192	msedge.exe	119
PID 5192 wrote to memory of 5272	5192	msedge.exe	119

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v17Q-m3-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v17Q-m3-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x368,0x7fff1f77c188,0x7fff1f77c194,0x7fff1f77c1a0
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,8553760387298594195,9452011327537339947,262144 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,2059187056422849696,16863062477739227507,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,17745296928215265722,13667686755777174490,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:13
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,13495353726750922788,6576845010523639534,2097152 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,11875596798729328544,11754662212121260235,2097152 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,4856203434841251552,12736204822714437650,2097152 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,2137143476629170360,12039484891853016561,2097152 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,12266681360564596280,8542193048945661344,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,16036189254135696239,218467510702100070,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,12752963162102721272,8964348219959453867,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,4999706593323071121,7259800408937631757,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,4999706593323071121,7259800408937631757,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,10543433348704630267,6428739186884735373,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,18005094343881916950,1662245777919793164,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,3552799875347740073,5989189676665532888,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,15358647506200004705,16086683718309597096,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,16809713934614682985,12885642196692830006,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,9523057047136014758,18031462934763168414,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:14
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,4821105743722367196,11772017208173366932,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,5875203857386748583,6528291794802502396,262144 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,8179861250886891199,10465559995669491668,524288 --field-trial-handle=2256,i,4254665304704162493,10048333391388471307,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 74c8acf95f7716e5d931d4555b9d49fb3bf9634ed84befdad76c47ee9e0ee23c
MD5 d2f8cc3cc1330f2997fd3bfc9ce23ff7
SHA1 4d0a6618a5b0edc8adc774e056886d9a8ae4c0e2
SHA512 814115f112090e49e55b4aab35431e65b301da9ad586c2f0c52ea2c958ad97ca36de8d6a808e9d51b31f4f47a9006dde8e663760c883952789c41435d729e962
TLSH
T1775162A78325CBF9D71585B371E1588C36F084B523476E12A04BAEB69966F1C72D1133
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596d66.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596d66.TMP
Size 3KB
SHA256 e3aaf45c4bd2f6f61493a0d25fa1b6047f53437e30ca4ad38d23dab6df89eff2
MD5 0cde7299ef3bf669fcaaaa34c1e058db
SHA1 aae590eea2492a3874d6948b3cb33cfa4d113264
SHA512 62ac82beca4dc77b66a444cbd915c01669fd0693f3b069190c5af9c41c464a0e492a66b3fde3bd5e5c5beefe05b576969191620c247e18ec9650424e3e28a4d9
TLSH
T1D95162A38325CFE9D71584B371E1588C36F484B523476E13A04BAEB69967F1C72E1133
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d8f704a09de818be814489a17c41e4c86662a3b669b42a7023aa3936baa7055b
MD5 31c6721cd940b5a8cf768c25908079ea
SHA1 64e79dd4e832a2c4a377baefae2d424047a16afe
SHA512 49d951f5ce0288080ce7abfbcb0e2bacab63d50bfbd90f416cfa96889289c20146f6d557b2c5e9bd8dea76d87a2c4a76ced379cc27675b97e850c03a083b5472
TLSH
T18241BDF783F8856E890156F0AA146E2BCE2D0511432C7D5AC9E0EE2B93F3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f2aa6a2216ba2e56afe8875b935d765548e6c4744b28d6580b12dfcb91e65e54
MD5 ff25986c44905236ab7a8b1065cb1e3f
SHA1 e6e36c049431657af6f698b0a69d6dd2f6a8ff7d
SHA512 08100143084346557a8d1fce8247533059905421115c87b681d8bb4009a712e6a87dcf5a5eb863de53aed55c2e9252817943f001c333bee09ad44cd126a45aea
SSDEEP 192:sxRkRLCs/fKs+jIZqkC5XzoA8p4E/g6+WNIYEmc3VG6tIgDSdJ:sxRkgs/fKs+j2l2+h/5INPs
TLSH
T19C42B7166E68A93B5CC7E21DFB55BF53D3F95432A0911E48AAFCC61C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5dd5b13499ea246e67b76ceba744d7397358b6707c72e0d46bbbb6f89a79b5f5
MD5 274fa0c451568d076ae7cc864e05c82c
SHA1 a4e4ef2ff0679365e4b3d6bfd4955b36398cb169
SHA512 11ce32ef5b103d1adfd80c76c6114479fba68c6bceec7a502307e881af8874de37d62bca54ece4f7aa22e2865252a2857927e95f770a6b0ca8bcbcc5fc23dd6a
SSDEEP 192:sxRkRLCs/fKs+UIZqkC5XzoA8p4E/g6+WNIYEgK3VG6tIgDAdJ:sxRkgs/fKs+U2l2+h/5IzP+
TLSH
T15D42C8166E68A93B4CCBE21DFB55BF53D3F95432A0911E48AAFC961C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9a576c2c7c93e2e9137f88adcc7c4f9c5796c7c1b20366a887ddb5dd562b4193
MD5 9ac5299de085fcc247c45b0fa2505283
SHA1 9c35aaeb4f7a7f52e225b759499f01d8ccfb9dae
SHA512 cb9c0d113d774ce50439aa935a90a279313133ad851793fe0372e1617aa83f29f76b01b22856b879289dbb34a42a5a535a2182e58a448802d310cbd43bd65c29
SSDEEP 192:sxRLRLCs/fKsDUIZqkC5XzoA8p4E/g6+WNIYEgK3VG6tIgVdJ:sxRLgs/fKsDU2l2+h/5IzPh
TLSH
T17D32C7166E68A93B4CCBE21DFB55BF53D3F95432A0951E48EAFC861C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 f524d10c134d5c5e61ed0f71cdfbdf919d269f405321221d032cf15c6a25b8c3
MD5 a393980ad4168ff6eb5eb0f2e50518c9
SHA1 0f3b2c9f5da87655372412f007ca6bf324c70504
SHA512 e121832c8a1708075c3f0e82906f904fe876c67c8c3003e6f7b9a766beb6361b06125d40f58c0a58c773e2cd7da4e123012e6b629169ba7478699039376cd721
SSDEEP 768:40Dk6DJQD8MF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVY5:40Dk6DJQD8MTE7N0DbWgQ6DjfIQDFu1U
TLSH
T141D2DA7B640CCB7F4F804ADDAD197A9E6D6802CB96D8C98047FE891C02C7BEE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7e0a5d41c77f30d923613f21476f8b9dd19ae5ea783985c9003cd471442d2567
MD5 3a5445a34d037712ac0017c0daa14b3e
SHA1 f4fc49bfbe2530d5b0dd780544bf4ada10677f2b
SHA512 f7b14a01aab62af7f2d8ae7c6e39eb0c902fb866ec5c5ce6f2c66be016f990a890cb60d261817ac0a3c3a776d30f4ca6b3ce0c4d92559626dd7180054dd2f671
SSDEEP 96:KRgRkQiOCYWm7LgYYK49gKYcY4rKQ1HfItpfd9xWJmsgRxK44g/xcnvOR8jMnTlX:CgRkQiOCPm7UY89gK3Y4rKQ1HfItpfdp
TLSH
T1AE916280357A03503C7E7A0C95AE992A53D27C63350CE87B7BAA11A51FA7E174CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff7e3d8c-2a2b-4981-80d7-677f8d07a6eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ff7e3d8c-2a2b-4981-80d7-677f8d07a6eb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9e25963d5c873ff7a3c3afc0fedbdcdb56d41a688f1cb4e9829205afa85100f0
MD5 5581095c65012c75ed23967487a6a100
SHA1 35fe09386a2f16c13a4d62984adb67dbdae084d3
SHA512 f08ee4cf4c6cd627e8d83cf8e9be6777f6d22f080c7a1ce5e8e5f0618f7664176013c5a347de4584582f4c524e2954a32fcc88ab05b44e7158b2d80caf68b3c2
SSDEEP 768:bl3p+cgcDTd+Z/+l1tZeX6+qTko0u229a4vsT4Pi9P0tI:bl3p+ttvVTVKa4tPrtI
TLSH
T1EFF2BF70F8A59D7388AAE785725632436EB515B3D6C81F44DADDEB0C064716C2B0BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4e94f69d94a4a2d3abaa9f7baa86cfb1479ff9949e275436e357794453ad5c82
MD5 8603ef990567405067bc9fb357fcfd56
SHA1 1104223737759f5fe365873d27f1cfa21c6ca747
SHA512 b39247f4394010c215a8648684743fae092d3e7fb9e2bc7c403ff23ad409a5a9b2ae401c24bb5ac7fb9a9067565714b3466d4b76035d9048731409906d6753f9
SSDEEP 768:yFQp3owgL+c6rnZ/+l1tjeX6+qTko0u229a4vsT4Pi9P0tI:Jp3s+V9vVTVKa4tPrtI
TLSH
T159039E71E8A4CE67ACF6DBC5B70672479EF411B3C6C899C4DADCAE0801871AD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a5817224864edb83d6117767e346c4dc041e3068398f02f57d00dfc7b4877cb7
MD5 260416e57b15bde34a7694d248c8068e
SHA1 ca228d1c94102dca7ce00f4aa96be574978bf14e
SHA512 0cd5f13e7fe8cac222bba2318847309efacb271441d0e8108a60950499879f44dc16d9a1bb891ea66d8e7a7751f3a636117e2e0fe1178aa735e98cda3fd0b2a7
SSDEEP 768:prv+4UNbdG301NDTd+Z/+keX6+qTko0u229a4vsDOeVH1SdW:pbsbU3RevVTVKa4rEH1h
TLSH
T1A103CF32F8A98A778CE6D784724775472E791163C7C80B90D8ED6F4D025B5AC270BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 443afae5ef2eea4d6bc17ed462c53626d26b154978d60a566886ae08a71aa134
MD5 58a1d396fdadbc134adfd41607d9a5d3
SHA1 74dcf01fef0c5cdf4d462aef370d2c7d8aef55fb
SHA512 00e25b0d16d889e976e7ec531010a5825100ba248498c8a94f0e66ec6c4bf9ffdd69a52ae3c6b9d79fa47de28228a6efc9a33671be7b30a83f895f0825808a72
SSDEEP 768:5rv+4UNbdG3mRCDTd+Z/+l1t8eX6+qTko0u229a4vsS4eVH1SdW:5bsbU3mUvVTVKa4iEH1h
TLSH
T1D803BF31E4698D7389E6D784714772872F7821B3CAC40F94D8EDAB4D064B19C2B0F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 44123b96d035e8b9f194a8c47509f1ec0cdc85f62daf75c0952a45c97ec89666
MD5 bbf642d7e37b7516220da793ff65d45d
SHA1 8d72b97bf415bfbbe8f11a27d566ca4873566cc6
SHA512 636256f4e9b65859288627855e7f968f03e48bf24b6645b2dffdf44ec9c4fb4aa99cc3f71bd2004d865c0f013667e4b88ad85a6fcab1c385ab59dc4dc531130f
SSDEEP 768:3l3y+c6cDTd+Z/+l1tZeX6+qTko0u229a4vsT4Pi9P0tI:3l3y+ptvVTVKa4tPrtI
TLSH
T11DF2BF70F8A59D6388AAE785725732436EB515B3D6C81F44DADDEB0C064716C2B0BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

7043f3f8-81d8-45cd-9503-b889cfb4247a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7043f3f8-81d8-45cd-9503-b889cfb4247a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5192_1064309294\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download