2356f4f2b651efbad7c8ee7f8e4dcaa51b9ce28d95394fb3a5254447f93818e1

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v15O-m1-eL.svg
Size 44KB
Sample260816-e5z7eazzhw
SHA256 2356f4f2b651efbad7c8ee7f8e4dcaa51b9ce28d95394fb3a5254447f93818e1
MD5 2afb4097fb2218401ce6072aa93f8307
SHA1 faf6a9c1effa6293ec2021eac520dce00486f4e0
SHA512 f66dca04fa73cbae407bab6bcc97525d8d397ef065a220094ce93dcf717293611e9f00d05915fc2d4c5bd63b27ce5714f07b8b27c62cc32ab4efccf5b81dd84b
SSDEEP 384:c827NHdmDcvlxO4fnH5AomEkJW9mOx790u+wycg9+fiUCFRlg0vlg90rf2:c/NHMWaA90C
TLSH
T1CF1340B537F43C9B8BCC034B6D42FC6C46BF94B78458668C9BD790E89548368B7AC5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_1878925112\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_1878925112\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_1554348872\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6076	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313283395062532"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{C903BA73-B3B1-4580-BF49-F2A6439747E4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 2836	5604	iexplore.exe	89
PID 2836 wrote to memory of 852	2836	msedge.exe	90
PID 2836 wrote to memory of 4752	2836	msedge.exe	92
PID 2836 wrote to memory of 6076	2836	msedge.exe	93
PID 2836 wrote to memory of 4752	2836	msedge.exe	92
PID 2836 wrote to memory of 4752	2836	msedge.exe	92
PID 2836 wrote to memory of 5464	2836	msedge.exe	94
PID 2836 wrote to memory of 5464	2836	msedge.exe	94
PID 2836 wrote to memory of 5672	2836	msedge.exe	95
PID 2836 wrote to memory of 5672	2836	msedge.exe	95
PID 2836 wrote to memory of 2480	2836	msedge.exe	96
PID 2836 wrote to memory of 5672	2836	msedge.exe	95
PID 2836 wrote to memory of 2480	2836	msedge.exe	96
PID 2836 wrote to memory of 2480	2836	msedge.exe	96
PID 2836 wrote to memory of 4760	2836	msedge.exe	97
PID 2836 wrote to memory of 4760	2836	msedge.exe	97
PID 2836 wrote to memory of 4760	2836	msedge.exe	97
PID 2836 wrote to memory of 2744	2836	msedge.exe	98
PID 2836 wrote to memory of 2744	2836	msedge.exe	98
PID 2836 wrote to memory of 2744	2836	msedge.exe	98
PID 2836 wrote to memory of 5868	2836	msedge.exe	99
PID 2836 wrote to memory of 5868	2836	msedge.exe	99
PID 2836 wrote to memory of 2564	2836	msedge.exe	101
PID 2836 wrote to memory of 2564	2836	msedge.exe	101
PID 2836 wrote to memory of 5624	2836	msedge.exe	102
PID 2836 wrote to memory of 5624	2836	msedge.exe	102
PID 2836 wrote to memory of 5704	2836	msedge.exe	104
PID 2836 wrote to memory of 4348	2836	msedge.exe	105
PID 2836 wrote to memory of 4348	2836	msedge.exe	105
PID 2836 wrote to memory of 4260	2836	msedge.exe	108
PID 2836 wrote to memory of 4260	2836	msedge.exe	108
PID 2836 wrote to memory of 1976	2836	msedge.exe	110
PID 2836 wrote to memory of 5012	2836	msedge.exe	111
PID 2836 wrote to memory of 1172	2836	msedge.exe	112
PID 2836 wrote to memory of 3652	2836	msedge.exe	113
PID 2836 wrote to memory of 3652	2836	msedge.exe	113
PID 2836 wrote to memory of 4644	2836	msedge.exe	117
PID 2836 wrote to memory of 4644	2836	msedge.exe	117
PID 2836 wrote to memory of 1488	2836	msedge.exe	118
PID 2836 wrote to memory of 1256	2836	msedge.exe	119
PID 2836 wrote to memory of 1256	2836	msedge.exe	119

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v15O-m1-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v15O-m1-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ff8eaa5c188,0x7ff8eaa5c194,0x7ff8eaa5c1a0
    3⤵
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1960,i,11792190705488217521,16418640481849687392,262144 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:2
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,11904088469430167313,10857119461990032207,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,18030207869598940044,2392848362297248755,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:13
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,391215788888237849,13459712601332181962,2097152 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:5672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,10633558844854513587,10252541455160397027,2097152 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,58794788826123503,16299323240400206828,2097152 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,7731281155856299439,843076496248911148,2097152 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,9525803558370996339,3594337436652074362,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,544544278952665379,11717969257013969891,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,13727720627704918020,6486727370820920044,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,9703099588594046255,17381558196514795564,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,9703099588594046255,17381558196514795564,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,12127089602426657176,10842753593774333439,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,7753872522075372224,14792630392163260342,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,16517800349780443109,4969760529378950837,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=1248 /prefetch:14
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,6109813024144852776,8282419880330998977,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:14
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,7867948813889994550,18065583649181827571,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,9102848417797493007,2894087252780948103,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,16469858285966021610,13603019535547420084,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5904,i,17613083105749325673,15782849791647903541,262144 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=1376 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,605506403764340033,14880733072512814707,524288 --field-trial-handle=2844,i,17127773061990651797,1164046868117066035,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
    3⤵
    PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e277d04e8a6e4444d85f917adaeeb37210819632ab74b031b9e0295ffd413f7b
MD5 40c71e2d4eb5562cad221d9bde1aba45
SHA1 2a7d2c1bb4853ee4d1eb060f0e3389a1f748481e
SHA512 c84165fe1b4f94d1e7356a88b50aac4f45887793a2ca6ecd647da0bf1c17627dd10edc392a196ea01a6309f9d0fed6460deec5deb0e8e30be69abad7e2cb728e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
TLSH
T18FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fe55920ee202e2822a66edc4a43a3e2d39e808f08001fe248bdba664ea557b02
MD5 0618dc881ad8f9477db6a85704551f98
SHA1 82a74b77c6317f748c898c966f63c78e84ceec43
SHA512 8269c7a54d49a033e8ed475bc0b88731bb4e2f1bcaa912e028dbc7093b2467c0e3285f31a65aebdadfbfb55ab77418a10e5c77908041c6df07a557f8a4f65893
TLSH
T188613ED2A3A10AE2E7354EBF44E1F45737F4CC5A81B31E0474835E746462FE0A2D5263
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590e10.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590e10.TMP
Size 3KB
SHA256 114b0d40002cf8fd41128d65ff6444a2b948e26dbe69fcb5d470468c8221ef8e
MD5 647c0031014f2ef65c8f98d9cbe7e7f7
SHA1 c547b1f68f9b7524d0f4ef5b5e26171e5b572eb7
SHA512 dccc46e7f2b60b619036a57c858d0c867b23f801e1ebc92df157642c7b82053eeade190ee8a000a23e9fa97f26da4742cef8235bb99983afe1114aedacde684c
TLSH
T1FE612DD2A3A10AE2E7358EBA84E1F45737F8CC5A85B31E0474835E746462FE4A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 edd30dfb29110774ce5418830d41beb239cae4eb27f971d2532d8466cf6fa36f
MD5 eca8f1fc71162aef25799a00d958f27c
SHA1 a913fc1585dfecdcda46d13eb59818a9bf3e2075
SHA512 968cc317ea8e9d2a2ffce2026b4460b5338f45918f4d0ca1cfecffce680d07c9f80bb411a609b1053408c8a2414d510f7566e8819dd511383c62f0dc562c1043
TLSH
T104418EF383F8856E891196F0AA146E1FCE1D0515432C7D5AC9E4AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a58319acdadbb097d0533c519b4d123a18d22fd6023c4a0370cc6a3c6c1d2f03
MD5 916b2de617f63259b7967211948309ec
SHA1 01172828d051c757ffa7f6d47b2552c1d9d6cd2e
SHA512 0494058f0773ac4065ad60459674444e68a782e8c1d6a16e9f19bef89ae5f8d3136427fb66cf00d8aec9188b2301460994b550ab070dad65bc390348d0a2b743
SSDEEP 192:sxRwReyM/jK1Ml8wCSf/f0sCXbnWZ6knzoA8p4a/g6+WNIYn8UrhyG+IgV+2J:sxRwo8Sf/f0sCXbngi3/5ITkIsC
TLSH
T15B62EA05AA346977CCDBE209FA557F53D6F81533A1901E48AEFCDA1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 558e4bca98534c879b56afabd834e0798d6cc1f69d1a70997cfcb0d052995d1d
MD5 6824e41b0382f2cc55d9bba30880bb84
SHA1 f4ef86652398bb5ef7e5682e716792035ae8d465
SHA512 82fab064eef5a31d98b2b2e21f0c9ac20de018b468de92d21dfc62f8f509bcd85fd7b5a07880e5ccd26c1d6f43b58e2afdb96bbe845049fef94141c65b7b5dd7
SSDEEP 192:sxRzReyM/jK1Ml8wCSf/f0sfXbnWZ6knzoA8p4a/g6+WNIYn8UrhyG+IgD3+2J:sxRzo8Sf/f0sfXbngi3/5ITkIiC
TLSH
T16A62EA05AA346977CCDBE209FA557F53D6F91473A2901E48AEFCDA1C00E6ADC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3ef48933294364fdd9966bfcd1c5edf15619c41d3233ac3a52f573dc988e6180
MD5 851074a0617048df21deffa9e9b3df63
SHA1 18a422a2fea251183d781a27809e9b1a7495cde5
SHA512 d86dd686b46a8f3ade4fa0ce50d8f3f4c0b1cf82ecc33e3a5c99bfecd9b1998a4ca3c994037a5fec7520cd5d3814cc5f6ab53ce67e43d401ad1c6316d92c3c53
SSDEEP 192:sxRzReyM/jK1Ml8UQoCSf/f0sfXb2WZ6knzoA8pea/g6+WNIYn8b/hyG+IgD1+2J:sxRzoqPSf/f0sfXb2gid/5ITVIgC
TLSH
T14462E905AA246977DCDBE209FA517F53D6F91473A1901E48AAFCDA1C00E6ADC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 5080684ff7ab8a906cc86c4a979bd3a33b50985c11dac9ee0ede6e6c29b0255a
MD5 0bf24fdacea5c87bcb9b86e18f07045e
SHA1 390ebecb96433fd47a0583357c457ba7e8daa5c4
SHA512 7e280b56fcea6a6d7ee852dba8e9a3db0442203fc6f9c69f38e7323567a5cf18db00e7541c5552cbe2cff6321348532be090b7411d7006f47a66f04d056f17d3
SSDEEP 768:wGed6g7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnKOu4YzroSE8Qo:wGed6sE7X6WgoufDMu1jaYKOVYAro
TLSH
T1E6E2DB7B680CCB7E4F804EDCEC29BE9FADA801CB5AD8895447EA840C03C57EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9685513b5dd5d8318c706662a1c93c3d9262c7d7093b07219bf1a606020913d8
MD5 e987ecda232001490f54bcfda020ac50
SHA1 d3dcd19b8bd9397e3aed91ec37f93904875b5aba
SHA512 c81a40714a3fa85935fd45b264456320e8dedaf3c4a3750d67dd5533e23a424f306a49ebcd0b11c1ae314ad5e6d22800ab0fca3a10d38b70d92bcfdfea235307
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHm7KmgIIOW4tVgGOK47g0OcOGlkVhKKK0P:CdqjXNn7Oj4XfV+gBkldQzLkHm7KmgIJ
TLSH
T138915500757A02843C7EB628826D9D5BC6827577351AE47B3BA811A34FABE034DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6cd9862-a2a9-4767-82c6-664922a0773c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f6cd9862-a2a9-4767-82c6-664922a0773c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0925e4a9e477ca521f8351baf59d2d88ceda159460fef89b5701144800458985
MD5 99e40480d0e86392b9b5d978d6825ec8
SHA1 08a8ad9a703072f8bb4bd0ffbd341d62ed6ea6d6
SHA512 1e9c34bb510c54ed4ad420dbe4e6ef9c8df2843b2ff427bbe91545d752280e05e7e31fa7965b788e8ea5603c8211648e6e13dad40d6fdf5db573cc13fae00828
SSDEEP 768:6rv+4UNbds3GwDZIO0tNzc4ReyIsXReVH1S5D:6bsbS3atc44bshEH1Y
TLSH
T16A03CF32AC789977ACF6A785B50B36533EF8511B82D81E94C5EE2F0C464B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d595b312d4d007d789b6911317f74f65f3933da0567396972244ef33944301a6
MD5 efb52974737aa5b6475a041fbf267ccf
SHA1 821f697a621a77c9091e5af357338c013042179b
SHA512 98880ac158d94d4c469064a3064cad3a54efe4e027b07bfdb1271a1fb08af6774a49908f8296b1eb567ddbe20af55d69f93798a4618a659ce142a9d17f5177db
SSDEEP 384:npZcI738NU0JuXsNHEVJDZNfNoXOVSUUq3heiAETRzcoXfK86sfxEZxxsIj4lB0z:h739ekDZIO00heYNzc4ReyIsP0Pi9P3g
TLSH
T126F2BE71E868DC63ACFAA782F54637927EF82167D0D41D88D5ED9F0C09832AD171B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 dd590ffbe1e9ef1e135399f6467c892720431d70eb0c9e50117943c56bfea47e
MD5 235988e68b671981acc62806ce67ec39
SHA1 3715f093997f6afb85c6d3a94bbb3d71b4a6bece
SHA512 3be5689a53f51e49f3d4f2d8e5fb7d05bffc209519bdb2a783510acee982a5ce53be0d98d29f12a204924dce22a9b598553db26f4aeefff4d265cd41dccb5e40
SSDEEP 768:Irv+4UNbdw3e/kDZIO00heRNzc4ReyIsP0Pi9P3+:Ibsbe3BEtc44bscPx
TLSH
T1B013CF31E828DD63ACF6A685F10736937FF8256790C40E98D9E99F4C09875AE271B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2d5ffb5ff145f64fbf506eaec174bc8860109951e8dc22791aecc78157249e1d
MD5 9a5462f3b910130d957ac0cda700fe57
SHA1 57624241fa0a34d7a6841c2a5cb9b6109951b1ed
SHA512 2e03635add62321854de9639b2e0294cf95d9064df778e573729d927e0711ac89c6ab76f5db58b0670a5be0296a45f8eec195d37bf036e7e9269ac9c5f7b455b
SSDEEP 768:mrv+4UNbds3fODZIO00heYNzc4ReyIs20eVH1S5D:mbsbS3Artc44bs7EH1Y
TLSH
T1F703CF32A878DD33ACF6A685F04736933EF8612B81940E94C9EA5F4C4A471DD175F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1978874c008a1901a1d6168c977cf076977b86d9cbc60f521d88c279e3b9f05e
MD5 3ea3a7437f9c42361e37584285dc3568
SHA1 c00659b5ba2733c11182f9deee7692975b73ac9f
SHA512 04140de1937fe370b574fb21fd101e66316b0404f79620834ea6453e4b759253518afb1d23eda4ff599b4657e447f2a9562b2fe53c566e382d1bf2e486286b41
SSDEEP 768:XFQ/3DwgBeFZQ5O00hekNzc4ReyIsP0Pi9P3g:q/30btc44bscPb
TLSH
T1B7038D76DC64DD6BBCF6AB82F6463682AEF42167C1D85DD8DAD99E0C048319E070BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

fe19c5d4-ca63-4340-82a2-643f6fa2a689.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fe19c5d4-ca63-4340-82a2-643f6fa2a689.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2836_534579008\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download