ff6ab6fab389da802db676a2f428f2254eebaef7d95f318360d8e9e1f3629140

Analysis

max time kernel
145s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
05/07/2025, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CrealV8/LICENSES.chromium.html
Size 8.8MB
Sample250705-ntlpbaypx2
SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
MD5 2675b30d524b6c79b6cee41af86fc619
SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
SSDEEP 24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_1376578488\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_1376578488\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_1376578488\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_187966002\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_413653980\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_413653980\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_1376578488\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_1376578488\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_187966002\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_187966002\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_187966002\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_1041750622\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_1041750622\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_187966002\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_1041750622\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_1041750622\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_1041750622\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_413653980\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_1041750622\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133961894445105145"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1418876453-2228697459-2788511057-1000\{9829D49B-0336-40C2-A5A0-4B0F07AD96E9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
696	msedge.exe
696	msedge.exe
696	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
696	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 1040	696	msedge.exe	78
PID 696 wrote to memory of 1040	696	msedge.exe	78
PID 696 wrote to memory of 2176	696	msedge.exe	80
PID 696 wrote to memory of 2176	696	msedge.exe	80
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 4568	696	msedge.exe	79
PID 696 wrote to memory of 5364	696	msedge.exe	81
PID 696 wrote to memory of 5364	696	msedge.exe	81
PID 696 wrote to memory of 5364	696	msedge.exe	81
PID 696 wrote to memory of 5364	696	msedge.exe	81
PID 696 wrote to memory of 5364	696	msedge.exe	81
PID 696 wrote to memory of 5364	696	msedge.exe	81
PID 696 wrote to memory of 5364	696	msedge.exe	81
PID 696 wrote to memory of 5364	696	msedge.exe	81
PID 696 wrote to memory of 5364	696	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\CrealV8\LICENSES.chromium.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x308,0x7ffcb88ff208,0x7ffcb88ff214,0x7ffcb88ff220
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1964,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1852,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2252,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:13
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3388,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3396,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4888,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:14
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4884,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5644,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5644,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5696,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5756,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6116,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5232,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5228,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5880,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=884,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:14
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5116,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5840,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5400,i,8548902821478999868,16978148549249872499,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\autofill_bypass_cache_forms.json
Size 146B
SHA256 b6c37df977f149c5a444c72ea4469ce666c7975d34c6e2e0d9d8ec416f57dd44
MD5 9357a694006d8bec3d0f8c9607b76ff8
SHA1 6335ce691999ec10de742cd07d074eb648631259
SHA512 87c2d0192f3a78b13a691cda14da507f260d13331b792eb973869bd6dbd0f207faa48f68882be691641b46c06ed12ee8b9728a3b596df67a1f9a4831b4369a44
MD5 SHA1 SHA512

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\edge_autofill_global_block_list.json
Size 5KB
SHA256 7655c9afb5f2ea39b18e302498b34009ca02b72451f82a6d4e7fb4d8d954f050
MD5 adb5f6058f82680a26d6ed02b44e5a21
SHA1 6197ee74e40c742e184357dcb6dfcc7e32818cae
SHA512 742dd8f6eaf1bd5f24b37e90d7a3dce7bd0a8edf399c2dec25cd92d2bd6e1d663ebab3c68234812f0144061d4f22f0c2c43de890f60e24d93133bbfe23a6d1c5
SSDEEP 96:MYL77CC6fQinLk252b/lF4NXtKK5b+QiG2ZwOSZqWqxtxpttx6lydMsSRa4/i:MYL7O9FnLk25+tF4B8K5b+QiGoztWuDZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\v1FieldTypes.json
Size 509KB
SHA256 f3232a4e83ffc6ee2447aba5a49b8fd7ba13bcfd82fa09ae744c44996f7fcdd1
MD5 c1a0d30e5eebef19db1b7e68fc79d2be
SHA1 de4ccb9e7ea5850363d0e7124c01da766425039c
SHA512 f0eafae0260783ea3e85fe34cc0f145db7f402949a2ae809d37578e49baf767ad408bf2e79e2275d04891cd1977e8a018d6eeb5b95e839083f3722a960ccb57a
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVI:Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e373291cec4f23986133c23daa353551f05eda26aac4a4e3686c40f8bfda576e
MD5 03b6ceee6d3294b477cb96be0a4821a2
SHA1 17508a8b887dac0d5b2fdf62cce6ee7989564165
SHA512 581fbd959baff647df5ac757c03b071653bca94c529807775b30e0f4b88ade1f0dd99850daaea1fa0861ce83d3e9d505a004e6c78d45e923ee39728a2d9efda9
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd
MD5 06d55006c2dec078a94558b85ae01aef
SHA1 6a9b33e794b38153f67d433b30ac2a7cf66761e6
SHA512 ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60
SSDEEP 1536:I6LPH74eshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:RPHjdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dda6e84d25dca7c36d30bb78cb89d314c54244daec088472a85a74386320c94d
MD5 b9d237c72da331d03bc8d85065a1a031
SHA1 e18423258152b6da6947dc6ec56cbc14f44e7096
SHA512 8a67def32042d72303c631044df80d4c0a1565821cb74b3c8030b31a06b6eb1a6fe38d06ae7b193ac17ad61e8996c31ac60d5a929fbbcc72dee567dbf1639e27
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 00358ab3d4190c8617e93a1a715630fb8a95cb6eb6a570e7ac86698dfab8aa7e
MD5 877b2935fb2931c49cf8575a7b54410c
SHA1 8bdbeb54e8adef0c52f6279c79fb361c0f6d2ada
SHA512 73f2245aa4d8655265b5f02f98e62c23219051dee1a2d7bfc3607a31e26a075952a2ae6031b47e577356a99834760af47e5e46976d50324c66aaae3942f0cc3e
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 4a01dbb94299e6c4694a771a19219df5708d45b1381bb950ec6086ef22778ef1
MD5 b18bb8a24de9ea23f719fbae29a1a9ab
SHA1 151658e613534f4ca7b414ed6eb40ba3b57a10df
SHA512 4e9c450c8f5748c43111c992e9f2e18f9c914baffd26e8d7d81f81ca091d4eb928c35dddcb95968055f34299631c5d4ce23d9457df54dd7c10682f2c7c26f504
SSDEEP 384:sVVnTH1EPp1GsRAZ0XSDY/S4UV5tKfvDgNqw:s3rmZAZ0Z/Sr5gfvDK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 a11add63db5ea2b2f48032186dc33af869b80e4243ffbeba06d2066f7905a35a
MD5 8de5d05e2aa4e3c472183a3204b0232b
SHA1 ba9efc18746137011e2bfd02338e66e00bb2067e
SHA512 715f48c4e95998edd5b82f2e26e9dad5597821e82c68c592e625759464a68c4b7ecea4d23cb697b6afe6038469241de52cdfa2038735c60a53a38f3894ba61af
SSDEEP 768:KaB7a8GX2IR7pLuLE8qWRWFTQBD8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3NJ2oLlU:KaB7a8GX2IHEE8qWRWFTQBDu1jaKNJ2Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 9a79c06d3c00eeeaf520d184f2162388912db89d69b3bb924cb84b6edaa627da
MD5 ac6fc482896f868c5ee4c025ea87d484
SHA1 6f9c37fb82e633a551a72572fcffdb1b8aa8c936
SHA512 0a4e6740acd352cf75dda52e019bcc7db1c04d2c49056375f2dbd0050e3dc7eea0da2e042affd8db4646b77e334e168a7852c8f10f367be2b92b47e7d7b79107
SSDEEP 96:iQZ8gKe6QO2DcYQKQeyYzSnQyPSfmyU0EyOc5CCyKQ4w6xYxkevCusY8g4Q9CGgH:yT44iToE7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.11\data.txt
Size 137KB
SHA256 5e4014e267eec120e673cfbc407e4340c234a7898319b35a304ed6ea343a7999
MD5 1bee2c36cebf096d8a559d5c4eeacff7
SHA1 c695eda67f31d729dfc336b8a471ad6346a39031
SHA512 ba520d383be95d8b15140b7e38e4e7ac03077bbbb8ee5326ac4162be9403bc9f0576e53840fc22cd9c4038f19f60bdeb7b4e8e0125da6ed80670238de812b4b5
SSDEEP 3072:iOmkTNO7NHrMziBxfPURO+/bAipYbzVS72Ag7KnM+HfACMR0T4H:i7kMRIziBxfPe/sipYbRfAPfCaTU
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 462B
SHA256 3465745cfdaa8b517d829d3e96a977b18828f4879972b2769dd9d795e4dab515
MD5 30910ab5b9eb2b1481dd8fb59f2ea14f
SHA1 b2a96d925b2e2ae11e4be2fd97aa7a41a2118e4c
SHA512 be8a1e7b3dbb5e1f377a872c82439ede340c883c18867d11ef82f324fae3df071acf4e143d32e72fdfe6c320aafad4e954f37d815791f5937fd2f6053f62a9fc
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 ce655da9b249bbed0af445c22435b76ef4615f20e99c0ae2542352698fc6c27e
MD5 088c91df6dfce72b522c6e02bd72f417
SHA1 4285b67ab49056fc2b63955eb1514f2895f36cbb
SHA512 bc4e568db38747f5a88a681156fb6e14e2f87cc385a372c92db9e2ed8e0e43008a958fe17e05149715780cdfef3fb88c48e9a3c5de5df67ca4edb0c3ba0ff01b
SSDEEP 768:kFXDE6esE8lDldUG13/CghU8hGwbdweBpElwj5+4bkVXBuseE1x7ovGqsW7iIKue:EfeB85dd35g3lwF4VXBZeE1x7WGeiAe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 aa014bb8ea1d3c248ddd3b0431f1e14ffd6156601d1311c20ba3aa5e13eb3962
MD5 94c7bf8a1976bdaa0a27c8a3256ca437
SHA1 db9955f84b02b42615f378d1cfc95aa80e288e46
SHA512 ba6aa70e9b1180fd173487d530afdda26d84670ecd07bf10d7e9db1af76748b0575aecbfad08bbd33f1402619c6e792eb86d7e70132a6fc1665a07098f9be01b
SSDEEP 768:JFiE6esE8lDldUGz3UCg4SB8hGwbdweMEMKAO9PeRovGqsW7iIKu8CE1x4L:oeB85d73FHg4MK/qWGeiAtE14
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fa32abb841187dcfa7e287f04b5f33a9723ede6f023e544fee4494291feb24b4
MD5 26910c694f12cd12cd7914107ab861a6
SHA1 6adbbe72649ea3f805a4eaffe53a4632158d70f0
SHA512 ea54553452644e0e2193a3db748e8c7abea941b8af3921851dbea0da181e0761b3c3713a920bc6a64b5e932a3eb46346e86ad13b7a14bb8a8862845e9e90f510
SSDEEP 768:PFiE6esE8lDldUG23/CgwU8hGwbdweB2EZovGqsW7iIKu8CE1Jl4L:+eB85de3ugIZWGeiAtE1O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 fcf35243f08cbd704572b5c4b5bda654a9522f2fcbb64e51630e0062d531c45c
MD5 a4313f3c87c8d381572435286db90867
SHA1 471f62fd0201f1c500c1f8e3d0c9c7777405cc2a
SHA512 93d33dd5a9d004d5338f48f409ea680f8f281668b65b20b520659ba24f2df06f1106ac67ef472b5c5f76afea0c353a726c22bdba9a264d510f543957aba90a84
SSDEEP 768:PFXDE6esE8lDldUGE3/CghU8hGwbdweBqElwj5+4bkVXBuseE1x7ovGqsW7iIKue:xfeB85ds35g2lwF4VXBZeE1x7WGeiAe
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_1041750622\manifest.json
Size 119B
SHA256 1148c28e540b9b96237b35170a547a13165d6c7c039b8fff9e4b2cd774b92f5a
MD5 390af74c5ae643320cad0cef4fa8fee1
SHA1 22ce727f9bcff9a914eb1d58ba8384de6fbda7e1
SHA512 deaeeeffdddea1a9047e97d82e3bb701fb865adcd77ef9e985bb0ec5e4057155e7b83cad4f9f3dd256edf89f19d1075349cea5005dffff8420da4d0646be413a
MD5 SHA1 SHA512

Submit Download

deny_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_187966002\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_187966002\manifest.json
Size 176B
SHA256 8a4800ed5f63b9371a024c501ee2b031af94539e32e6753214e6d99c625c018c
MD5 8177721150435a9b333475e2b8a6e691
SHA1 8aa8981617e8f3d8967a0a4a2d20315317eba293
SHA512 540c4c52030c6a4e1efcfab5eb59760c696bb3e3f1b8f93c97a6368639a911ba3d395190fc0798d99f3c63e25b6dcf2ded482bbda34d36ddd874dd20c2cfdf74
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping696_413653980\manifest.json
Size 53B
SHA256 0f8ee89c4a420bda691d058cdd96c874c2edeec84145c81c957e98d05e351d3c
MD5 b4d869dd7052d78d29b3e439565f1600
SHA1 caa2cfa31729f4348a02514eba0235e72b88ce5a
SHA512 1fda3488df8c43ad413b2e69a5e2292322fe837f7b27b88302b4e591e7e13fdceacb0af9b8bb92ca7c0d2b39abffc776c6cc35d18abb86ce91f55c719b43480e
MD5 SHA1 SHA512

Submit Download