1d9b53e06f6dc11e0ed5e36f2b9db49ad3ec2e89d49c6a3145bac0b0f7d3bded

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v12L-m6-eH.svg
Size 31KB
Sample260815-sdchxsdl3v
SHA256 1d9b53e06f6dc11e0ed5e36f2b9db49ad3ec2e89d49c6a3145bac0b0f7d3bded
MD5 fbe7ff2e86a8b54be74f27046684d50f
SHA1 b531c269cd2db0071d54af48acfcf7e7df75f30c
SHA512 1e387530138ff05234d0aac670fa1eeabdf79f57daa7d565eaadb6241cf5638f60fbc841c7bc635de7e0986733668e33b12bdf46261311276b0267c8b77cb8ed
SSDEEP 384:ccozyutS3CQImOyA5hE2hgo910mF6ezh5O+uSHS7Ix:ccoLxn
TLSH
T151E22D6537F43C978BD803478D42FC6C469FA8B78498678D9BC790E8A94C368F76C5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1650603209\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1680256983\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4228_1680256983\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1360	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312796225231008"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{AA414E59-1813-4958-9F28-600B742D3333}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4228	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 4228	3644	iexplore.exe	89
PID 4228 wrote to memory of 5116	4228	msedge.exe	90
PID 4228 wrote to memory of 5852	4228	msedge.exe	92
PID 4228 wrote to memory of 1360	4228	msedge.exe	93
PID 4228 wrote to memory of 5852	4228	msedge.exe	92
PID 4228 wrote to memory of 5852	4228	msedge.exe	92
PID 4228 wrote to memory of 5088	4228	msedge.exe	94
PID 4228 wrote to memory of 5088	4228	msedge.exe	94
PID 4228 wrote to memory of 2168	4228	msedge.exe	95
PID 4228 wrote to memory of 2168	4228	msedge.exe	95
PID 4228 wrote to memory of 2168	4228	msedge.exe	95
PID 4228 wrote to memory of 3780	4228	msedge.exe	96
PID 4228 wrote to memory of 3780	4228	msedge.exe	96
PID 4228 wrote to memory of 3780	4228	msedge.exe	96
PID 4228 wrote to memory of 1284	4228	msedge.exe	97
PID 4228 wrote to memory of 988	4228	msedge.exe	98
PID 4228 wrote to memory of 1284	4228	msedge.exe	97
PID 4228 wrote to memory of 1284	4228	msedge.exe	97
PID 4228 wrote to memory of 988	4228	msedge.exe	98
PID 4228 wrote to memory of 988	4228	msedge.exe	98
PID 4228 wrote to memory of 2716	4228	msedge.exe	100
PID 4228 wrote to memory of 2716	4228	msedge.exe	100
PID 4228 wrote to memory of 3824	4228	msedge.exe	101
PID 4228 wrote to memory of 3284	4228	msedge.exe	102
PID 4228 wrote to memory of 3824	4228	msedge.exe	101
PID 4228 wrote to memory of 3284	4228	msedge.exe	102
PID 4228 wrote to memory of 1776	4228	msedge.exe	104
PID 4228 wrote to memory of 3680	4228	msedge.exe	107
PID 4228 wrote to memory of 3680	4228	msedge.exe	107
PID 4228 wrote to memory of 3512	4228	msedge.exe	108
PID 4228 wrote to memory of 3512	4228	msedge.exe	108
PID 4228 wrote to memory of 3248	4228	msedge.exe	110
PID 4228 wrote to memory of 3720	4228	msedge.exe	111
PID 4228 wrote to memory of 4672	4228	msedge.exe	112
PID 4228 wrote to memory of 4148	4228	msedge.exe	113
PID 4228 wrote to memory of 4148	4228	msedge.exe	113
PID 4228 wrote to memory of 992	4228	msedge.exe	117
PID 4228 wrote to memory of 992	4228	msedge.exe	117
PID 4228 wrote to memory of 4628	4228	msedge.exe	118
PID 4228 wrote to memory of 6116	4228	msedge.exe	119
PID 4228 wrote to memory of 6116	4228	msedge.exe	119

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v12L-m6-eH.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v12L-m6-eH.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffdf071c188,0x7ffdf071c194,0x7ffdf071c1a0
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1968,i,15209773702315461707,317284675191256021,262144 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,8987731218222597514,10479204427913650832,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,8408741891081609419,3116603803100629002,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:13
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,9612349739603567621,12569287605216942648,2097152 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,12795071496969681451,175437769613545832,2097152 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,8169592059716152360,4221630304853726910,2097152 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:9
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,542115485029296905,5367957047366362833,2097152 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
    3⤵
    PID:988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,5831732749135784523,9988518306154669720,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
    3⤵
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,10068416241265487324,1475959680804613665,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,10490772603052811694,18223532836232762608,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,1238943771999771206,3361614414591559766,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,1238943771999771206,3361614414591559766,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,12102398191139987729,8153607321246843970,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,16773764095234884551,4661127520089976220,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,8987285014666023469,6726921488515633791,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,18060004934706975056,12088858346190372395,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,13522901584223411792,10112869526866206324,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,11203783979613526386,6795604433005160093,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=936,i,12712698373533445213,9818186183258201617,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
    3⤵
    PID:992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6212,i,622287471726692690,11685511961584584801,262144 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,7975061422148266523,16712877895521957688,524288 --field-trial-handle=2512,i,17742029279742537814,7476076634870594288,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
    3⤵
    PID:6116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b71d17f69b9c1276db026d4b34f87fffe19d716048636d091562c08bd8e43f86
MD5 f4bec499de7a71209530f6a0fc4b800c
SHA1 ea98303d22f1764fe1fb0b431e4632545041b5d0
SHA512 f7f8b821a2cd48959d59277944fecf6cb79611e896527158692b61ff2a9bff34251064d123cb76c1d18ccd06d03654b449e4c4cfde09829b3866d7edad1ab287
TLSH
T13361B6B1532209D0F329A9BF20E2D04B32F1B645553F2E201288AF742F06F3590DC07B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5954ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5954ec.TMP
Size 3KB
SHA256 361ee4de5bce211c1962efa8c25bf81525916d3b3b40e05e33a1149b7084c9bc
MD5 fdd9f2617a21c6452f5469e9ba3a9707
SHA1 c7b815db1bcbe1e40875791520cead3bb0162fa2
SHA512 1ba9c6c135a1a59efa6794a4d3de9ed2662b3d0bc8d950a4d0ceb7fd74d827f797fb4b08d5feeaf11d53038cef6ac57581fd7e37cd2f138b0e1e43b9203b9fe1
TLSH
T1686195B1532219E0F329A9BF24E2D04B32F5B646593F6E241688AF756F06F3590DC07B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7d2012aa21065c2c636b872529f129b90678892263c4f61b698a7f6dc427ecf1
MD5 d03c08de851cedac356e05012ac3ef6e
SHA1 4112f23e87b8ea31daab235f1277bc8bcf1919e3
SHA512 88e20519843bb6b4e88b465b2c805ae1e71a6c34d7e728b05d1fd5999c2582cf0bb3006ded7202cf11984dc45d766afd4d762e7388cefa7fef1fad97e757e6da
TLSH
T18A418DF383F4856E891196F0AA146E1FCE2C0515432C7D6AC9E4AE2B93E34B1E18195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 db44f858c398215c600b39bbae723cb46a674e9f039af3720f4a8239dc68193b
MD5 f97db801cc2c970dfc259d906eba8ab5
SHA1 c2c0e21f8db1239f0d5ee8894ac186f388a4ed3d
SHA512 e7c28b6f309099ac6e3f97764c85aabf18c8218a861b78ebaa3554f5989595cf1f5bc28c88f72879f2c4118d2ebc7a83e1cea35208deab9ea92a665ff5f2421f
SSDEEP 192:sxRARiC4/fcs+X6rZpzoA8p4x/g6+WNIYEg73KGxqIgV0J:sxRA34/fcs+KF0E/5IaWu
TLSH
T14332C8166E69A93B8CC7E21DBB557F63D3F91032A0D41E58BAFC8A1C04E76DD520740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d80476116639f4fe5cde5e77f0d6efd7697981147d5f2b6bcdefae6c1c8a251a
MD5 bb0ceb4a00a67fad16c7d733a52c36d2
SHA1 e281b5ca7e23cdee3de7588c8a3a205808aec5d4
SHA512 7cce48fada2569dfccf2cf5265224ec0dd7b9e0392455b6f23893d3dcebc8691be2dfbfb90f0926bb6eb609cb1d9f08bac0f30e48a70e3dab4333584bccb2776
SSDEEP 192:sxRjRiC4/fcsaT6rZpzoA8p4x/g6+WNIYE673KGxqIgDC0J:sxRj34/fcsa2F0E/5IKWn
TLSH
T1AD42D8166E69A93B9CC7E21DBB557F63D3F91032A0D01E58AAFC8A1C05E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 273d2f98a5d8f5df9fe1aaf1dfaa8023af57295cb40fa6aae11447e0853d132d
MD5 e292039f07249d0791ae5e6dfb643b35
SHA1 30325654db615601eb141f6b9e34d03c80086237
SHA512 dc3179319d24fbf77bc304ef86cea1d536092368957e2516e8bba89c68314ce7c651b02e78bd4ff8e4d8503c89cd124f7df6dfbeefdfbcef21ac4fad467c86aa
SSDEEP 192:sxRjRiC4/fcsaX6rZpzoA8p4x/g6+WNIYEg73KGxqIgDw0J:sxRj34/fcsaKF0E/5IaWd
TLSH
T1E042D9166E69A93B8CCBE21DBB557F63D3F91032A0D41E58BAFC8A1C04E76DD520740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 0950355489af19c0fdde24a5b0d1fda8d8ab486251c1cfe0fcea4fd8b9ed932f
MD5 fcc83c4988a0846af89779b1ac3b7a8c
SHA1 d423e94fd029c8ec72f748532e21547f7f5b204d
SHA512 638be9d9c8a18118d6f81864237fc552cc1bf880a145ac5e764f8eda3a6fd8c37c7533acc87e55a2ae3c8a34df7607380df4327d7acb1b20c99a496d19e6ca1b
SSDEEP 768:40Dk6DJQD8FF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzv:40Dk6DJQD8FTE7N0DbWgQ6DjfIQDFu1F
TLSH
T172D2EA7B640CCB7F4F804ADDAD197A9E6D6802CB96D8C98047FE891C02C77EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

323a1b6f-5310-4b8d-9484-3c20bc0d3173.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\323a1b6f-5310-4b8d-9484-3c20bc0d3173.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 fa9787670a1c3ce3104e998896907204d8630a0f4eb226449fe421c08ab9ce37
MD5 cb2ed2c7d51b090bc24da4bc4e45e5d5
SHA1 604e8e4c252166e16c36aa7dca728a01fed457e8
SHA512 267b0849baa7e98c296b7a9ba4962de92fd4b4150114aef93ac371f71015b015754bbf2f3e81f54b4ffd584671ac9c8b17100c9b27066053389e0506cb24b29d
SSDEEP 768:gY30U8DTd+ZGeX6+qTko0u229a4vsTrPi9Pp:gY3n1vVTVKa4+PW
TLSH
T1D4F2CF71FC669C774CEAEB85725726536EF42173E5C41A48A6ECDB0D058326C1B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 eb4ec0cc9d6656efa0b8ed209e8ea2946e52ae223a8d6f536e42e9aa83446be4
MD5 881d52208722cc7d41ecb0b5b8eb7a6d
SHA1 6e59ae7be21ca97c60ef2ee9996260c3ac83d121
SHA512 f9d6b1e759429c5a886fc5e6bc958e9dcf4e093b49b89527bd9b2d26a69c28acfd685a8caed38a359b039a5044f5d2ff90fbe7d20d0439c9c80b57ae333cc5c8
SSDEEP 768:prv+4UNbdG3bloDTd+ZjeX6+qTko0u229a4vsDeeVH1SdW:pbsbU3fivVTVKa47EH1h
TLSH
T15303CF33E8698A778CE79784714B35073FB96163D6D80B80D8ED6B0D068B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 8eb893fa440086b7de88e99539250ec688e094a6d3c23060d3786fde332d55ca
MD5 ef14c1b84ac2fdfd0583a1e22c781bed
SHA1 39e27e8fdb6be0aaa25d18be0a49bff33c6c1003
SHA512 55e60410e75b4edad1e8a6f7149ca58c8db0df0b20b6b66cf3d3ab19f844252a0310d749dfcb2205c0114787bc629d6b5a998c49b7fa8fe2524126460f962055
SSDEEP 768:wrv+4UNbdG3luiDTd+ZieX6+qTko0u229a4vsSreVH1SdW:wbsbU3mRvVTVKa4dEH1h
TLSH
T1A303CF32E8698D738CE69784714B36573FB821B38A880B54D8EDAF4D064769D270FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e6fd1620a50083922e94da4b655ba5e9d0235fa1941a08e0aa64745429b97681
MD5 45b1503f193330b528fa284cef17cdf2
SHA1 74c309647269449dc8677d74d27ab77868f65da6
SHA512 a9e88ed730357beface4c239b86b7088748a6557d6bb1a5432bc4a6d93db5aaca84c2c9f53e47b8c77866e1b34f6e55942f76f8bf1f68e35c6f3002bea8a5c06
SSDEEP 768:mFQU3zwgfUTnZWeX6+qTko0u229a4vsTrPi9Pp:tU3MFvVTVKa4+PW
TLSH
T1FE03AE72EC65CE7BACE69BC5B31636579EF411B3C5C859D4EADC9E0800832AD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 63c0d3bf2df77176181ada8ec3049efabfb3c85a047df7440475bd780af484b7
MD5 db3eacb3c844386d7335d269fed555a8
SHA1 96207c066fb73d21a19dfc5309cc341e47e6c6ef
SHA512 824987e49422e2d6cf580f8065f0aca181097353346af36ef84f0b0ba57798be82240ba392a227625e97a6cf6d4ee6ca8dc1342ce423dc3610a474ca22219378
SSDEEP 768:JY3zU8DTd+ZGeX6+qTko0u229a4vsTrPi9Pp:JY3A1vVTVKa4+PW
TLSH
T186F2CF71FC669C774CEAEB85725726536EF42173E5C41A48A6ECDB0D058326C1B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e3e20cff7fdd5d966be0bf08ff2b8b71984c58a85fe3827aadec4ab5907f0e40
MD5 29e13a25abf7897d6a4429c89bb7884c
SHA1 c29aac28fc1e917bb45fe4195c565a0993874f8b
SHA512 7286accf38ee369b9965b93c93978796e97186f0731e5c28c6f20e43854bfe1526721593fbd8d5898ab800c76a8aed27419d1be3c333a459674f51e045890760
SSDEEP 768:Erv+4UNbdn30n8DTd+ZpeX6+qTko0u229a4vsTrA:EbsbZ3EovVTVKa4+A
TLSH
T1A003BF32FC699D778CE6D644B10B36537FB820A399C40A54DADDAB0D02472AD2B0FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4228_1775167624\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download