c2f5b199320bbc3fcff20bef28f02acbe7697e2a9d1afe31bf7d66b180423a31

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m1-eL.svg
Size 3KB
Sample261001-tk7hbaxt8p
SHA256 c2f5b199320bbc3fcff20bef28f02acbe7697e2a9d1afe31bf7d66b180423a31
MD5 2226f49d0e59c46b4a18649eb679ae54
SHA1 c969dfea4218c1fab67060e9393a7fc24cc5547a
SHA512 a155996290a9d678506c7112a083decaa035069718b565052611fd751a1fb9378bb55dbdb09a8fabc2a0f5caa91dfbc2eb1e106fb2f9cba9c2f00608c0720af7
TLSH
T1C771368876F87EDBD7D802570D41D4B84B2F906BD822978DD3CBA0E8792826C735E5B0
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4428	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{C61A9114-C5E3-46FF-B94D-7EF2F23293F2}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4752	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5296 wrote to memory of 4752	5296	iexplore.exe	89
PID 4752 wrote to memory of 2644	4752	msedge.exe	90
PID 4752 wrote to memory of 776	4752	msedge.exe	92
PID 4752 wrote to memory of 4428	4752	msedge.exe	93
PID 4752 wrote to memory of 776	4752	msedge.exe	92
PID 4752 wrote to memory of 776	4752	msedge.exe	92
PID 4752 wrote to memory of 4808	4752	msedge.exe	94
PID 4752 wrote to memory of 1432	4752	msedge.exe	95
PID 4752 wrote to memory of 3068	4752	msedge.exe	96
PID 4752 wrote to memory of 4808	4752	msedge.exe	94
PID 4752 wrote to memory of 1432	4752	msedge.exe	95
PID 4752 wrote to memory of 1432	4752	msedge.exe	95
PID 4752 wrote to memory of 3068	4752	msedge.exe	96
PID 4752 wrote to memory of 3068	4752	msedge.exe	96
PID 4752 wrote to memory of 3972	4752	msedge.exe	97
PID 4752 wrote to memory of 5724	4752	msedge.exe	98
PID 4752 wrote to memory of 3972	4752	msedge.exe	97
PID 4752 wrote to memory of 3972	4752	msedge.exe	97
PID 4752 wrote to memory of 5724	4752	msedge.exe	98
PID 4752 wrote to memory of 5724	4752	msedge.exe	98
PID 4752 wrote to memory of 3400	4752	msedge.exe	99
PID 4752 wrote to memory of 3400	4752	msedge.exe	99
PID 4752 wrote to memory of 3504	4752	msedge.exe	101
PID 4752 wrote to memory of 3504	4752	msedge.exe	101
PID 4752 wrote to memory of 1328	4752	msedge.exe	102
PID 4752 wrote to memory of 1328	4752	msedge.exe	102
PID 4752 wrote to memory of 8	4752	msedge.exe	104
PID 4752 wrote to memory of 5652	4752	msedge.exe	105
PID 4752 wrote to memory of 5652	4752	msedge.exe	105
PID 4752 wrote to memory of 3612	4752	msedge.exe	109
PID 4752 wrote to memory of 1852	4752	msedge.exe	110
PID 4752 wrote to memory of 2584	4752	msedge.exe	111
PID 4752 wrote to memory of 3328	4752	msedge.exe	112
PID 4752 wrote to memory of 3328	4752	msedge.exe	112
PID 4752 wrote to memory of 2096	4752	msedge.exe	115
PID 4752 wrote to memory of 2096	4752	msedge.exe	115
PID 4752 wrote to memory of 368	4752	msedge.exe	116

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m1-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m1-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fffc32ec188,0x7fffc32ec194,0x7fffc32ec1a0
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,10350111826938627575,14383946705063094498,262144 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:2
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,8901893831977376148,5659359079768666574,524288 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,13684603383235610646,18395495001517697345,524288 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:13
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3292,i,13850958215012536330,8133060083884009373,2097152 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3304,i,15021271210939818892,3448311132950663636,2097152 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,632907990456681053,1472991643325569182,2097152 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,3338409618966349240,17975352161916183795,2097152 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,13878874609665812101,12313046499736757839,524288 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,77911445672413669,13727738965089559581,524288 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,8862428169668678395,4876209823555264031,524288 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,16493375887253853020,15537808581468202505,524288 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,16493375887253853020,15537808581468202505,524288 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,17141557302240468232,6183233053939889252,524288 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,487367977739578374,17721112943161695230,524288 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:14
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,12944418396856484237,1678025632826052715,524288 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,3775936483319001703,8951830089286897718,524288 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,455599401248538635,4422140726828485983,524288 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,15285650557414999536,72058976789498997,524288 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6568,i,17160396644338596685,12904772031212712029,262144 --field-trial-handle=3124,i,14723036109201331557,10407254557203528619,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:10
    3⤵
    PID:368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5b4409001ba448cd605f1a45b116c8f08305a3e499e3921649d06707f51839c3
MD5 afe6264a6b18eeea9189a050771dff5b
SHA1 f8a453cfe12af7aac3f068fc2fd00b5c20ab269c
SHA512 fa901dbf1bf959821bde4ecdd6484918fc2c9dd3ae0115adf3ed9511ac739db52b646acb6a190ac8ec29dcf22ad8b27acee284d42fdc42e99067231ab93cfb94
TLSH
T15C512CB1B63489DEF7480230B6D15C9F363106C0748B1FD217A8EBBCF95A39E40AC218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59abb7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59abb7.TMP
Size 3KB
SHA256 eb49f72a4b4c89c4255c2758ca62cd365626ac3b0c7df881c25ce81d2d8b39e7
MD5 3851940d31eeb9da8d0da905fa3503db
SHA1 1585493386d22e8aeeb56f272559a20d8c8528ce
SHA512 7754d753b41db91c23e6fa6f34837f35ec80259bade72dd9637dfd7a1f6f030522e46e57db4c7ed9df97b3da9a66f859ef1a0d15b5ad602610e362551a208b85
TLSH
T1BF512CB1B67449DDF7580270B6D15C9F363106C0748B1FD217A8EBBCF95A3AE41AC218
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 707f1d9ac7aecb39326135e8c99799e06605ffa4115cdd4991b46cb4857965c3
MD5 932366b6c34b3c5e9b1964793867f662
SHA1 9bcf8a4291cdbd68a75060c1e13db1b378b6fe6c
SHA512 fd0da286fee15c909bd1444297611f673486173cc0256a48561e6414ce7972e6b8e288ebb8fe6534d5153955a3c4158e93a646bc6c8aacbec3435b772c88ec15
TLSH
T1BD41BFF3C3E4C56D890195F4A6146E2BCE1C0915432C3D5AC5E49F1B93F3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 84526a660b39aa15f852a7c6fa91e0b0e2aaf32bdcd0727150d537e2c0e1dbd5
MD5 98815f1fa7fc74cc72ff1f3500058cae
SHA1 9710f8688a5cb2db6ac5e15d165645a249245a4a
SHA512 97418e067048da7b9ba0ef7e4360d1ca211a3a0ca734f288625c3967fd057d2162e6260a0929bef2196c77e1bd61e1dd6c8462762282053639a2a5f1384a13a9
SSDEEP 192:sxRqRqCU/fQscacJD4zoA8p42/g6+WNIYiAa4GwIgDZT8J:sxRq7U/fQsca0DBf/5Im2
TLSH
T18A42D859AD28A97B5CCBE21DBB657F53D2F9203260911E48E6FC8A1C04FB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a176e7f1c84b99d2265e30252dab41c6e5eac588c4ad0f2028625440e9d97f10
MD5 06e4997cf9e9825c4153643d4b156bc7
SHA1 2372a5b435cf237ef7a8eece948df460108a5f0f
SHA512 842973834cf09d3de67e6c307712943109a3161eb2eb4fb0c04bac26b66972aefb316d2d3208bbb511ec9cffe0ea3026d35121632302fc6ce557dfc617c202ea
SSDEEP 192:sxRqRqCU/fQsfacJD4zoA8p42/g6+WNIYiVa4GwIgDLT8J:sxRq7U/fQsfa0DBf/5I90
TLSH
T1A232C759AD28A97B4CDBD25DBB65BF53D2F9203260911E48E6FC8A1C04FB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c3a57e7267667d8df9f0e1740e2bb79aaa64c3ee496a315f1ac42b0511abd0bf
MD5 cbf7a32565a94497818ca2fd0329ac35
SHA1 1665099c0a1aca58760e3e4c8c0e425d71a11016
SHA512 284a2c4c8633b0167eda57ae43f3be5c6aec8de3399a25d646725eb9604017eceff7807d9b7e0c7764e94c0c9b39c0e1ac6712280947d12a3c0a0bc18e506e59
SSDEEP 192:sxRpRqCU/fQsvacJD4zoA8p42/g6+WNIYiVa4GwIgVT8J:sxRp7U/fQsva0DBf/5I9G
TLSH
T11B32C755AD28A93B4CCBD25DBB257F53D2F9203260951E48E6FC8A1C04FB6DD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4e9772d440c7c6c5e106c0d2cb3491ec837c026ac4e9d3c457a8ba355b0c89bd
MD5 d5dd3f6d2bdb41cfb59a9b6330df9b87
SHA1 146390bdb164ca50607a4d0938f4055ab7da5622
SHA512 3f4970265c8bbf230db3f7e4322304e0467cb55028146c98bd97485b8cf94575ee8202b269419c0f7ced29f1fe60c196a788660e329596a9165e52a8bf7395f6
SSDEEP 768:XIDm817pLuLbdoWgvHfnv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhIlj5roTkD/:XIDm8DEbdoWgvHfnvu1jaGmjyTkj
TLSH
T1B0C2DA7B640CCA7F4F900ADDEC297A9B6DA802CB5A98C94047FE941C02D6BEF51164DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 00c9ccf1febfaf0bdbc61697bac35c4032b15c4a65683250d06ae2807d1ccb2e
MD5 813a218f4eef37174b0e3a31b9cd6663
SHA1 10b03598ddd3007446903c3e6668830f6f8b7d3a
SHA512 0e6c6a099632ff6464e81c0e712d7e168637c81db6b71b3b81bd120471f7867e419d2c523e995c7987d2b5710211703c7ddef74f804e90a899fddd31519dd0fd
SSDEEP 48:KUoIvK1+cTyPfqT/dFF+/VolI+f+KlLNh+5HuQgRJyVtIBKes8n:KUowK1+K64YKJmQ+tuKesg
TLSH
T1D9912020317B1241397E3518A4E0AF6A064671A33474F97F7BEA14928E6BE044DFDCEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a473c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a473c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 dfbb47518546f87c7af2efb47d1d8f0b4e1d557b5d9ab6965e136b0dca5190a7
MD5 9ece089b910352161b509ca5f604e4db
SHA1 9d7b196da265479b5ac9299e2396f4a75acbc35a
SHA512 c6992508c706aac4dcb8bbd500efed3a064a9b0af970b19b0a9cf5304da2643ec7d669c5b4f3e92ad2f46d04b757f3865a21d1d2de6a93a81784099d4b6d541d
SSDEEP 768:1n3MencZ0rfZW2YohpYoPBw4Ot5AEl94BHYjHoq4YGH7b:1n3MgBVa5AEncHYjx4YU7b
TLSH
T19AF2BF75EC758D734CFAE7C5BA0637866EF051A3A8815EC4D9C86A0E098329F170BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d0eea3810450219e189100a8a7206018f62b9737649b0a58b4c17ab0de2d583d
MD5 cbb5056d156dba6b8791aaf62634a861
SHA1 e1e062c8187dba45cec3c4b9e98f155c69ea05da
SHA512 35f007261a51e76dc48b702447a41f2b1b7e001bb478a4bf6121f0f95ad609fb866bb0495cb6b32e01f4581f08514173979bd270b53c9fd0ebdc26e56be4b3aa
SSDEEP 768:6n3vencZ0rfZW2YohpYoPBw4Ot5AEl94BHYjHoq4YGH7b:6n3vgBVa5AEncHYjx4YU7b
TLSH
T1F5F2BF75EC758D734CFAE7C5BA0637866EF051A3A8814EC4D9D86A0E098329F170BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d910f6e778282d25ce2885e7ef4aac2cde8683ea69c675e8dd68184ea7e951aa
MD5 8eb556a0a9119d21d295ea352809ac1a
SHA1 73c9e41a687507654eb8bd007e2379564cd248c8
SHA512 f02d40836d8e56fb5e79eed8f4dd78f91b7b22e134c041a47dc615df610c92373787fe26c6c792deae0b7893b5599a62004133db57d0ed77189302ee316f84cb
SSDEEP 768:z/UxvxjgC+b3NScZ0rfZW2YohBBw4Ot5AEl94BHYj/6AFTN/:GZj3+b3kBVa5AEncHYjSAFB/
TLSH
T1C703BF39DCA59933CCF6A7C5770B3347AEF19463A5C16ED489DC2D1E0A8725D130B80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 786a9345c5ae44f9d8a66e8fdb7f6ee15b00c40945457b79bc402d4d06c4aaf4
MD5 fc291d43f0448216220497dde5caadbb
SHA1 f71fdd70f5d89941c33d244cbb374bcaee330300
SHA512 b1043d9068244f261edbc344ed9c6251b09172f45e5e71406419274c3a2572f4fe87b7aab765a916ddc654716868ed6b92e366cd3eda6f2d007d4d43c46246e6
SSDEEP 768:J/UxvxjgC+G3gJncZ0rfZW2YohpYokBw4Ot5AEl94BHYjHoq4YGH4t:8Zj3+G3gkBVa5AEncHYjx4YU4t
TLSH
T1EB13B039EC659D234CF6E785B60B37879FF154A3A4825ED49DD86E0E0A8339E170780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 db901647844fb48a29e92f3cf15706576b4ecc1c5432116a0ed1826ea0a27e34
MD5 8e3568333e473d0aa49944ab9e38f5e8
SHA1 84cf02a7c60692e99bc0e5dab9594e78791b5606
SHA512 b73e2b867446d9ffef6c7a0b4b60b6ce6cc163a9c94a6e7f42ac279244d80a199fbd8d1daaf226136f71fddf7b828765c4ff51d570361f1641096af2ebb5ddbb
SSDEEP 768:QFQR3HwgXeP0zcW2YohpYoPBw4Ot5AEl94BHYjHoq4YGH7b:DR3VWBVa5AEncHYjx4YU7b
TLSH
T1D3039D7ADCA4CA77ACF697C6FB0676469EF051A388859DD4D9C86D0E04832DE070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

88e372e5-1007-445f-b806-0c6de8a039cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\88e372e5-1007-445f-b806-0c6de8a039cf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads