3b57fea1eec2d03a39c344332db1a425f7e728e0bcf2afafd5f90352bfa4e14a

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v16P-m2-eQ.svg
Size 48KB
Sample260819-25pf8sysht
SHA256 3b57fea1eec2d03a39c344332db1a425f7e728e0bcf2afafd5f90352bfa4e14a
MD5 36e987192c44bf8a98cc83525c6860ab
SHA1 c2bbafef0aa4819ca038878ed030e235bf20353e
SHA512 51b10e0979e1185dd44631fa0e92cb6839b417135169b8d23b95268775147c7b87cb47a12307570476a595a81167526992f137c9009e50d73a3e1d80080f7f73
SSDEEP 384:cl1tz67bJ/MErSDkAPI9Fs0NsHJCixiIX1dkWs4Cl9sRCOWnCAX+3utANO:cDtimp7s4k9sySO
TLSH
T1202350B537F47C9B8BCC034B5D42EC6C45AF94B784986A8C9BC790E8A548368F7EC590
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_539886527\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_539886527\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_21101530\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4380	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316546182454037"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{69661BBF-E8C2-4172-AAEF-081FE34F6F5E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 2148	4612	iexplore.exe	89
PID 2148 wrote to memory of 4400	2148	msedge.exe	90
PID 2148 wrote to memory of 4380	2148	msedge.exe	91
PID 2148 wrote to memory of 1512	2148	msedge.exe	92
PID 2148 wrote to memory of 2920	2148	msedge.exe	93
PID 2148 wrote to memory of 1512	2148	msedge.exe	92
PID 2148 wrote to memory of 1512	2148	msedge.exe	92
PID 2148 wrote to memory of 2920	2148	msedge.exe	93
PID 2148 wrote to memory of 4636	2148	msedge.exe	95
PID 2148 wrote to memory of 4636	2148	msedge.exe	95
PID 2148 wrote to memory of 4636	2148	msedge.exe	95
PID 2148 wrote to memory of 2676	2148	msedge.exe	96
PID 2148 wrote to memory of 2676	2148	msedge.exe	96
PID 2148 wrote to memory of 2676	2148	msedge.exe	96
PID 2148 wrote to memory of 2772	2148	msedge.exe	97
PID 2148 wrote to memory of 2772	2148	msedge.exe	97
PID 2148 wrote to memory of 2772	2148	msedge.exe	97
PID 2148 wrote to memory of 1204	2148	msedge.exe	98
PID 2148 wrote to memory of 1204	2148	msedge.exe	98
PID 2148 wrote to memory of 1204	2148	msedge.exe	98
PID 2148 wrote to memory of 2704	2148	msedge.exe	100
PID 2148 wrote to memory of 2704	2148	msedge.exe	100
PID 2148 wrote to memory of 928	2148	msedge.exe	101
PID 2148 wrote to memory of 928	2148	msedge.exe	101
PID 2148 wrote to memory of 3536	2148	msedge.exe	102
PID 2148 wrote to memory of 3536	2148	msedge.exe	102
PID 2148 wrote to memory of 1964	2148	msedge.exe	104
PID 2148 wrote to memory of 1936	2148	msedge.exe	105
PID 2148 wrote to memory of 1936	2148	msedge.exe	105
PID 2148 wrote to memory of 2956	2148	msedge.exe	106
PID 2148 wrote to memory of 2956	2148	msedge.exe	106
PID 2148 wrote to memory of 3256	2148	msedge.exe	110
PID 2148 wrote to memory of 2136	2148	msedge.exe	111
PID 2148 wrote to memory of 5512	2148	msedge.exe	112
PID 2148 wrote to memory of 1824	2148	msedge.exe	113
PID 2148 wrote to memory of 1824	2148	msedge.exe	113
PID 2148 wrote to memory of 988	2148	msedge.exe	117
PID 2148 wrote to memory of 988	2148	msedge.exe	117
PID 2148 wrote to memory of 4688	2148	msedge.exe	118
PID 2148 wrote to memory of 5172	2148	msedge.exe	119
PID 2148 wrote to memory of 5172	2148	msedge.exe	119

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v16P-m2-eQ.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v16P-m2-eQ.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8eaa5c188,0x7ff8eaa5c194,0x7ff8eaa5c1a0
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,6974446360911561764,9348594528694360149,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,248920281909526405,4190278093935144414,262144 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,17073415510048676451,16909340181637139523,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:13
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,15729738946630361032,1125147525927631270,2097152 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,8882093813130102228,17456960850008464318,2097152 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4412,i,2031654926219036786,12035969542214040836,2097152 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4428,i,15228516531289248347,451284655708149052,2097152 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:9
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,10888371315679043623,16584307228841043065,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,14471313280754090095,15796751114511469975,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
    3⤵
    PID:928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,2888300423289725959,8785993037575412821,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,18322553084344633218,6902012732548062051,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,18322553084344633218,6902012732548062051,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,2736458981398916247,11528328023460650674,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,1661358609166226957,6241406663993107049,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
    3⤵
    PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,12169873111728909332,9441049828513382403,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,10940355470434031114,14096614807298923435,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,9194662546711609926,12021519625596132921,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,13137251991878417438,17022592441696661537,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,15339921120893318165,15067113487006058460,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
    3⤵
    PID:988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5676,i,14817226776991505843,12950778241544247248,262144 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,11259953848716646939,15512316061740777681,524288 --field-trial-handle=2592,i,1355434551290513506,13777047338631951307,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
    3⤵
    PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44ad41f86fc5dfdef9271828918ef29a810e56b8958f687546cd2d840b9240aa
MD5 a5cac29eea53b9fcab74bee9fa34b5ae
SHA1 f8ce725ee9f0504c0c06499e9e661e57b450faea
SHA512 b9b4caa28d7e2513df4fe005dbaadbee5271cc930e71893250588b597acfb3d61d0eac54efc7443d690048513be0217cff1f84fceb1bc7dbb7a69e098a92df54
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
TLSH
T1B0B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e119d5134d9d260b795dc460c61bcaadb324f5c0526c217a3d1fb47a4cbf6c56
MD5 9424ca789070065b353f5f0fa7e9ed9e
SHA1 b1716e5cb5a5455cb06d9e37e01917f874f571e6
SHA512 6dfc88e14a58e7b024066122335b5c6f4a6d3dd89bcfb4b0e95879093c449f63b69c5b89127ef4735697d4e6fb2c1f1967f7dcbf653da5c1b75555790df859aa
TLSH
T1F3612ED2A3A10AE2E7354EBF44E1F45737F4CC5A81B31E1474835E746462FE0A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59136f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59136f.TMP
Size 3KB
SHA256 edf251d33d9068c05beba3ba42cfca5d33bb8ad96e62e858d46b4555c7b1381b
MD5 2908a1fd9ade3c3b03f3a99a08ba1fb9
SHA1 51bc2705f12fddfe0858e64adb3297909c954258
SHA512 1ba4977ab3389f4a3a0b47ade7cb6e6ee349777abae74ba660cf607d5c2c5d4d16d3dca41f81fd1d902528d92f4390a624ccaa959fca7095513a84eb902096ad
TLSH
T168612DD2A3A10AE2E7358EBA84E5F45737F9CC5A81B31E0474835E746462FE0A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4a39ebf281cfec19312c8cb0835affb45d8758a840963ecc5ce6d673618e4916
MD5 4baa793e8f144ca9fdfe9f92f33c3329
SHA1 e079d9b756b5f621c0eb1a6eaf19cab41fb5a902
SHA512 6031a689bc0a06e5f550fd3ee6a3b1890468152347268cffd4a614a2e6e40dc92069dfc754616fd5c9d1f0227a5312f1cd422ef78a7fbb8c7f71e9e38b288de3
TLSH
T11C418EF7C3F4856E890196F0AA186E1FCE2D0915432C7D5AC9E4AF2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d0a6fad7494fb9e336f60874d4f701f664ebb7c2eb386b37196bf6ec4b45f7df
MD5 7d9289bfd3094fd83d3438b06eb50574
SHA1 d6efc1a2584fc0cae3c7af30bd8a737e63cdce33
SHA512 b53a4bdc4ef791b92211faae07898289e7d83969c7a0406485275e7c8a4b269a4220ec442ffbfb5cef53abf28de2f725efe06e47fa4344bfb7fcf070c3ef8d09
SSDEEP 192:sxR1qRdyM/jK1Ml8wC8/fVso0ElZVzoA8p4w/g6+WNIYn8U7hiGCIgDWtJ:sxR1qv88/fVso0EL4h/5IT4II
TLSH
T16762E815AA346977CCCBD20DFA557F53D6F91532A2901E48AAFC9A1C00E7ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1a7d2b75b4e52be746d14827d87f0728cbfb8a92fe171812d49e9842ad817c3a
MD5 cad9c02161b11e98a306bc589bef9da1
SHA1 6113093cbe291816fa6c36170343fa1cbb610c1e
SHA512 ac71e67b9b47d97a3b7700ac5c906fff73cfb2f9ff62b0d5a05a10db86e7d7b3445ac1160e0c093dd0193225e4148c67b406c373a1f99927c2b593c50a9747fa
SSDEEP 192:sxR1NRdyM/jK1Ml8wC8/fVsf0ElZVzoA8p4w/g6+WNIYn8U7hiGCIgVtJ:sxR1Nv88/fVsf0EL4h/5IT4IN
TLSH
T13A62D815AA246977CCCBD20DFA557F53D6F91532A2901E44AAFC9A1C00E7AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 36f57bbfa615b0ae919e1003c0cd7d4dac1c53b46a7c2730daf71764c4888c18
MD5 f82ee97c751e062d5455d008daf32e7d
SHA1 311f2789ab46f786e7b365eb8e3e75ad28c4e517
SHA512 9c43982ba3e326561356e11b759ea0c7d86382bb8fe072c6dcf24f40263d68c3a61dba458afce005d87079784b9f2e384e51c032b874abea225bd828b5453bc4
SSDEEP 192:sxR1qRdyM/jK1Ml8UQcC8/fVso0OlZVzoA8pew/g6+WNIYn8IPhiGCIgDMtJ:sxR1qvqb8/fVso0OL4f/5ITiIW
TLSH
T1F062D715AA2469778CCBE20DFA557F53D6F81532A1901E48AAFC9A0C00F7ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d09edc16d3b5985fbd5a6014a2e6cef477c59e9c4b773fd7320c68140f6cf022
MD5 c710c584998dc74c7ab44368891ea9f9
SHA1 ade15cd84ccdee39742dd9d933d92af0533c09d5
SHA512 fbb1c9df867115e79fd264668683661854997a66a3d0dd452b04cf17e3ac052efc0c7806d3ad00cbb3e825b7eddbc0f7ebcd17d15343f1f0a2921d2427e4dcb3
SSDEEP 768:wGedsg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVW6Ou4YEroSG8Nx:wGedssE7X6WgoufDMu1jaJ6OVYPYx
TLSH
T1F7E2EB3B680CCB7E4F804EDDEC29BE9F6DA801CB5AD8C95447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5c3b1bd7be618a1a9820227425149269dd77508c5e5180497532ff0fbb935dec
MD5 6ae466fa8239c7cd7b8c9df5ba162e91
SHA1 af4a5834a177cc46c89aa92ab8518d222778211d
SHA512 ea6deb73c340371d429bc8b8367513a702baea6ab2cd14913cd1f1ed2cdc27947a9cd741f92e67d6d1a1988d39e66e9088ffeb1d61cdad88fbdcedfef9bdffa7
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHm7KmgIIOW4tVgGOK47g0OcOGlk5G4K7Kh:CdqjXNn7Oj4XfV+gBkldQzLkHm7KmgIz
TLSH
T1E9910500747612483C7E7618927C995FCB8174B7311AA86B3BAC11A65FABF024FFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

166693f2-d8fc-4bcd-a907-2da72b0016c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\166693f2-d8fc-4bcd-a907-2da72b0016c6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 fd84eaf971cd3e7eb4bf2f9a1bd3df9858d2e4162f8bab835529a86fd5b8c5e2
MD5 00cf37f13e83d18c5dbf3a5e42f64754
SHA1 aa21fb24b76552005f300fe3f56e6f26da2b35f7
SHA512 df6824e0fc950422ab02ab92ec94f2a01817b77dde8387a5bf053cd55047cd0024487b772e87569bd35bed6826c8e055e8f93a49fd94fd213628bce573162566
SSDEEP 384:nFZcIXR38NmAzLgTWUmVJDZNfNoXOVSUUq3heiHETRzcoXfK86sfxEZxxsIj4lB5:9B3SjUmDZIO00heBNzc4ReyIsPZeTsKg
TLSH
T1D7F2AE71AC74ACA3ACFAA286F5073693BEF45127D1C81D98D9ED6F0C04472AD171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5218159c7e9a862f401164531d35c793193d1304ec460e7f839668233c77a4fb
MD5 b047e5e0e78d7b60e3eebd0cdfc57893
SHA1 814fcd37a2767c97de2610ed997bc733dca36f97
SHA512 595521a21bff3a1272a8c8fa8ae948a7d6a4b4e0b4d522675bea901a3bc9395e5e774d7f8ea1542275c0dca942ba43a95fc2fdf23a4dc451101a699d3a2adb28
SSDEEP 384:zRZcIXR38NmJzLgJWUmVJDZNfNoXOVSUUq3heiHETRzcoXfK86sfxEZxxsIj4lB5:VB3NtUmDZIO00heBNzc4ReyIsPZeTsKg
TLSH
T160F2AE71AC34ACA3ACFAA286F5073693BEF4512791C81D98C9ED6F0C04472AD171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 cec5e85c8718e51bcc8600f3d5da31615f205768c8450797bc2e9a3c0fdcb42a
MD5 7d1714956185525cc87d67ba96173bf7
SHA1 42ca54e9e9de8eedb2b0a878ea3f9b61d4da8292
SHA512 0ede589ded3b087cec81d3234c403bc2b31ad4ecad45a73ddceab0689e964fd8ec2eaa466f9d0f70d0b710aeb9275741c05bcd85ac1ee3322ce4fb0ef60febb7
SSDEEP 768:jFQc3pwgojUnZQ5O00heuNzc4ReyIsPZeTsKg:Gc3wjIRtc44bsheTsKg
TLSH
T101038E72DC64DDA7ACF697C6F6063693AEF41167C1C899D4DAD96E0C00872EE070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 cbe2b4c6a1ee1b6ea61e66cef5323c233c3f9166165818f84a803857fb4742f7
MD5 829e138e0074d8ab7ef6043de2a14e94
SHA1 78df07848989a51f486a5e421cf07e299d779a38
SHA512 5bb96d44f6f065cdd3c502c348392a9ca28bbaa65fa1b162eb25579e7a18c394833acca93a75db0a30984f07318265972dd949a2d0ad291245207a4a8aaca069
SSDEEP 768:Drv+4UNbds3/wDZIO00heNNzc4ReyIs2ZeVH1S5D:DbsbS3mutc44bsiEH1Y
TLSH
T1A703CF32A878DD73ECFAA686B04736933EF8612781840E94C9EA5F4C4A471DD174F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 958bd690279e77a619410137266189ebfb70c8fe0042be61a6b3c5ce79a11498
MD5 a7f080ec5a9510fde6ca935909ab8d1b
SHA1 386ffbb74c3b516c26af4560fc3493ff29adbc45
SHA512 4787c8c762465baebb7cf0955eceebf4a0274ba4bf4fc9d2700008f9db3fde74d7fb82f76762c0d23db67e1ff8153881cb60aa73abf549174586b0d1a40eaa41
SSDEEP 768:6rv+4UNbds3ywDZIO0tNzc4ReyIsX3eVH1S5D:6bsbS3Gtc44bsHEH1Y
TLSH
T12803CF32AC789977ACF69686B50B36533EF8511B82D81F94C5EE2F0C464B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

59e11f5e-7a68-4b76-ad21-fb2d1583a24c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\59e11f5e-7a68-4b76-ad21-fb2d1583a24c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2148_299228833\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download