6ae1be63a9694f157e34067f89e809a9aba36a7b8a0c0f10db38d3115ee5c700

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
13/01/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TalesMajEyal.html
Size 111KB
Sample260113-nc2dfact8e
SHA256 6ae1be63a9694f157e34067f89e809a9aba36a7b8a0c0f10db38d3115ee5c700
MD5 b35d8908e94d66974418efed8b84cca7
SHA1 7f70751a8e5e2f3aed3277b3349c61c8546e3c59
SHA512 0a2ccf03b3bd38cb7d210f35689862561b5f4cfb0afe52447053dde806cf20442b35ec7d17a357be7964c7ddab8f50389b3462ec724a5d3e69e0d2851ddf6640
SSDEEP 768:N0HdxX+UHvmIgU8c6yn8bnSwGL/c/xZ/r/c/UK/j/w/C9wEK+:N09xX1HkU8gAnSwGE1mDK+
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1603311058\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1413689884\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1603311058\Filtering Rules	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1603311058\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1603311058\Part-DE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_35377165\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1603311058\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_35377165\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1603311058\Filtering Rules-CA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1603311058\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1603311058\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1603311058\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1603311058\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1413689884\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1603311058\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1603311058\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1603311058\Part-NL	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4812	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134127765912136635"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3566265835-582343572-2256600343-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3566265835-582343572-2256600343-1000\{84B7C5B2-6D6F-4DD6-8D4C-05EE4C6964D8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5352	msedge.exe
5352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4700	4784	msedge.exe	77
PID 4784 wrote to memory of 4812	4784	msedge.exe	78
PID 4784 wrote to memory of 5064	4784	msedge.exe	79
PID 4784 wrote to memory of 5064	4784	msedge.exe	79
PID 4784 wrote to memory of 5064	4784	msedge.exe	79
PID 4784 wrote to memory of 2232	4784	msedge.exe	82
PID 4784 wrote to memory of 2232	4784	msedge.exe	82
PID 4784 wrote to memory of 2100	4784	msedge.exe	83
PID 4784 wrote to memory of 4084	4784	msedge.exe	84
PID 4784 wrote to memory of 2100	4784	msedge.exe	83
PID 4784 wrote to memory of 2100	4784	msedge.exe	83
PID 4784 wrote to memory of 4084	4784	msedge.exe	84
PID 4784 wrote to memory of 4084	4784	msedge.exe	84
PID 4784 wrote to memory of 5944	4784	msedge.exe	85
PID 4784 wrote to memory of 5944	4784	msedge.exe	85
PID 4784 wrote to memory of 5344	4784	msedge.exe	86
PID 4784 wrote to memory of 5344	4784	msedge.exe	86
PID 4784 wrote to memory of 3780	4784	msedge.exe	88
PID 4784 wrote to memory of 3352	4784	msedge.exe	89
PID 3352 wrote to memory of 1996	3352	msedge.exe	90
PID 4784 wrote to memory of 4288	4784	msedge.exe	93
PID 4784 wrote to memory of 5168	4784	msedge.exe	94
PID 4784 wrote to memory of 5592	4784	msedge.exe	95
PID 4784 wrote to memory of 4876	4784	msedge.exe	96
PID 4784 wrote to memory of 4876	4784	msedge.exe	96
PID 4784 wrote to memory of 4944	4784	msedge.exe	99
PID 4784 wrote to memory of 4944	4784	msedge.exe	99
PID 4784 wrote to memory of 5368	4784	msedge.exe	100
PID 4784 wrote to memory of 5368	4784	msedge.exe	100
PID 4784 wrote to memory of 5352	4784	msedge.exe	101
PID 4784 wrote to memory of 3608	4784	msedge.exe	102
PID 4784 wrote to memory of 3608	4784	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\TalesMajEyal.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffafb6cc188,0x7ffafb6cc194,0x7ffafb6cc1a0
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,18395592423932148089,9472786187356202764,524288 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,17894264888652050821,733639797804297519,262144 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,16557966775423564471,11310167056193752228,524288 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:13
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,1321332613856225224,1551103929770157355,2097152 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,2462736987622934728,2100187223070636723,2097152 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,2175455133269564860,3181322119875806247,524288 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,3847800676431391288,7007079680794496819,524288 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,9620677573502272252,8808048544322663354,524288 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,9620677573502272252,8808048544322663354,524288 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,13213603530190083070,14686143581736796599,524288 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,7859423968597821483,15135875934513433850,524288 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,16717136496717376771,15597739073934046509,524288 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,1195250940350341985,7545325414081107482,524288 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,5628836179372870181,1785625503447446713,524288 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,14380187433490113047,4527016940420154284,524288 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=1676 /prefetch:14
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,11770460670423381913,809160714709650550,524288 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5928,i,9724144102288935316,3571754350051320424,262144 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,17786057910927882960,15576920713611613360,524288 --field-trial-handle=2204,i,2385060001218621014,3723041067035842394,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f76ad90d0c26a736aac7e7a0f470b51334340ff042193947372f7abcccd3c589
MD5 33f32426713831a564dccfb9965689ba
SHA1 bf597294f7714df64daee3a88782542a0422e51b
SHA512 e8a8f458b20a1a7c9644295197d89bb1bdf0d70f1e8a31e114c4b59f972e0183aca3c4a920465288dbe8b4e95d61fcbe73a70c32a163d4fcbd2fe8a9333b46a1
TLSH
T110D0C09193D61007C08427735020D79033CCC8068043DA004173C7461FC11C508C0CD0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 4e676b26a032cc30d6e127254787f0d70cfcb6c00a846762f02fe62d23e7c23e
MD5 657ef8c8516a3741487819f8818c32b9
SHA1 c9e7aebc9cd25447b3989687b9b86d38c426be09
SHA512 2c1613590c8f574f8b6b327aacd07fd9a4e4f7312e2ce066e4eb1307523f021cf9b8256670b26c0a4e6f0e2727cbef9ea6b304ca311a75b4a347b0c5ad66c627
TLSH
T1C4F02DA5DD25EC3718FD072960644B4BE79013672680899F3B3D450D4F75537858782C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 84ab2d00a9c76d63c3edf4fd0139236f6b94e49bd7889e4f5f63f19941bc1ed1
MD5 902622d177776fafc9f85d74f2ab73b8
SHA1 deb767db94129ecffdcd2ff94970687033409107
SHA512 d219535bf4fd4b1561c34b2e0c9f3938de8a86a85aba4d19f31b413483d01cb6afe611077620907839f4340475f1468c2097318751aeef4a61c64a75751aea2e
SSDEEP 1536:IdcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHSRiPjU1
TLSH
T196B35227D6A54C6B01F16264EC794382F325436F9282A82F3A7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 106f5f2b26877ba61e3953a7df60d1805e0fccd9635c3f7a4f4fcc50ab088168
MD5 218ca418ad6c44575b0b835d7e9eec04
SHA1 edb5cc53745ecf138db2059c36aedae269aa7ff5
SHA512 455448010cca2397223231bd8eee6d83394481ec4ac997a34ba66290d36996af26180e44d036a4f014475d5b7269b2119904401daadc5b8a94f6a3fe40dfc4ec
TLSH
T18651AFF7C3E8867D890195F4AA286E2BCE5D0555832C3C5EC8F49E4FA3E28B1D24055F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 a53cc57c0c6247152b2e8804fecd909c865e0a5d738e1e1257cf55f876991749
MD5 13ae3b6f168e25e65fb490d651bc953f
SHA1 c860dc0aef8101d38277137038cb00e8c77be067
SHA512 a51d7e195158143ef72d640be9baa28720c201510be792247c2f88ee1e40648f695be17ed19712663e30c3868eb66d115c462879c4899b592bdb1c4ea2c64a1c
SSDEEP 384:sxZonWgPP8/fxsUVp2XbigI0/bfC5SjzT:sqWY8/fHVp2+gT/bq5ET
TLSH
T13F820802AA38597BDDDBD218F946BB53D7F81063D5844E44AAFCCD0C04E6BED221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 f2b06fb106135229c7fc447bff15b0d19a7367e63f549fe64de3d6e24a4ea969
MD5 0215cdad6ea20be975068a25d915979e
SHA1 fb48aa7ffba84246c4a044374177ae00cdb78318
SHA512 9255d74ab7f00563fc142b29e49002082dbf222e30cb3a91ce072bfadbc41e3679cbeb3cc5e5192ec35ba1aec0c91f4078169e68e062e63768e840249acffd87
SSDEEP 768:uvu668si2kJ7pLuLDl1WRmlzQ2j8F1+UoAYDCx9Tuqh0VfUC9xbog/OV36uVILlA:uvu668si2kfEDl1WRmlzQ2ju1jaK6uV3
TLSH
T12F030A3B6C0CCB7E4F844E9CED267E8E6DE8028B5698895447FA884C03C66EF55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 a75b4022a5b39f69f986f797ba778d1cfc517324aa178b5692a985b901448401
MD5 fad88c11efe49889fdf3feefba832c24
SHA1 e6959c69e1a58f971a3eebb1814c041fdef0aae8
SHA512 5537e89fd5215fbfed9ea743267635d4b4505a182c12ab655181b9a4c6b3d6493129cdb68f0a95a281e1f2313209112089e1821e9375df97e91f404dcbb8fb0e
SSDEEP 96:BqKZOe+K5v6KR+6zKK8vKaaOyKp/OKBSyfKaMmKV1C5KQaIKHiKnKGQmKJdSqXK2:4VO1dE1SfwDEnwkC6qx6Nkk0OO9MEV+A
TLSH
T193B2E811326E0280387E298AF9AD902F934221636160ED2B7AF8C0654E67D385DFDFDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 eca9b5d4f4a92e7435926d7c69c5bfc60059c8946ecb582a11cc771fefc2a27d
MD5 db1b6ea2a871b4375abccbb8d4b9ce82
SHA1 f22083e50d307b732f6c5619ee16f253066b78c9
SHA512 e59c7ae5039e9453bbf63a688bafaf140fb63ca19b3cc0e9e44531d4d5c7ad924c693aa16da0fe8c8641740abc182f61e3e8aa272d75c210486b31a747e33ee8
SSDEEP 384:nFiFRvqMZ38Nh8TUNTUlIRqno1Oderb4fVKJS5m6eO3oVu2+jd3I43DvnDGIpkna:MFRys3awgP12KJKXoVbMxI42I63PyR
TLSH
T170D25B72D868DDABEDE78F86E7197613DFE00197898C4AD8D9D91D0C00971DE230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 95843200b1f7424d6bc8f9b8de9e919350010db31c44ed5f4003a0f463101472
MD5 6f48ad418f677c10321221c0c8b36f11
SHA1 a95bc4bebde5397a762a58ff760fc5ac7a69c13a
SHA512 8f278dd024a2b60a4e700d1ccd00867e40fed7df9c8c5249c2246070befbeab64c2ed89adf0846fb6f57ec2af4c9c9e91fcefbcba5200bed17d4a23e8de98576
SSDEEP 384:n3iFavqMn38Nh8TUNTUlIRkno1Okerb4fVKJS5m6eO3oVu2+jdVIDcxatk0vI+Za:yFay03awgx42KJKXoVbMjImy3a
TLSH
T104C24B72E864D9A7EDE68FD6E70A7A13DFF01197898C4AD4D9D91D0C00971EE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3339a0809a3c18972912565a02dd18c0d0874b87d6089776d032e35da571f50a
MD5 756858d466a4eccd95b10bf2600d152a
SHA1 d4c25f58f6ed655f422fd23d7830368c8c0241ec
SHA512 34d3ddee2ad0056c8321ef5be9e4c59cf00f6b002d254efd6fd3582f2bf412c44a1a624ad4b73457c675555beea814a542be16768a3a01321850102becba1d9d
SSDEEP 384:ngiFavqMg38NF8TUNTUlIxBno1Oh1HLb4fVKJS5m6eO3sGm02uD3BejrNM1ecxad:7Fayv3OwgoaHWKJKXsGmizAjrNM1VyQy
TLSH
T145C25C76EC58DAE7ECEA8FD5A70A7603EEE00157C98C4AD4DAD85D1C10871EE530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0d93e1e558df46f0e7e5913969ac5c58dee76a4f5fbfd31450555953848e55bf
MD5 05e554c6dc25399e8cf459a8db04a791
SHA1 7274f6296f1c2a225c63ba8374294d0a8aec90ac
SHA512 32941b21cc539343d3b5a7f1eb85fd9d5d92c0a2bcccc632536625f7ba32fb177a158c85f360e6c171676e20c956d7e2adc09970d0b27b15e8aef45ad4731b2d
SSDEEP 384:nEiFRvqMn38Nh8TUNTUlIRqno1Oderb4fVKJS5m6eO3oVu2+jdmI43DvnDGIpkna:fFRy03awgP12KJKXoVbMEI42I63PyR
TLSH
T18DD25B72D868D9EBEDE78F96E7197613DFE00197898C4AD8D9D91D0C009B1DE230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4edda61e10a1ed8c4cc80ded55d1a4c50c2b3e5282f0dfb1e7fcd4b6166b32eb
MD5 53612fdd05a46139272d6d3893058fab
SHA1 c5744d2e54206a884bcf8fdb3194779c619b1e5d
SHA512 e7e0c9e67a66a3e91bb0e8a46cc906a25e5043cccfba5eacf10c60d2828f1445f14ed2a833e9dbdfd827587f340c19b612ae8a6a146ff0a8de20679660e7d162
SSDEEP 384:n3iFDvqMn38Nh8TUNTUlIRkno1Okerb4fVKJS5m6eO3oVu2+jdVIDcxatk0vI+Za:yFDy03awgx42KJKXoVbMjImy3a
TLSH
T19BC23B72E868C9A7EDE68FD6E71A7A13DFE01197898C4AD4D9D91D0C00971EE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.81\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.81\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.1.13.1\typosquatting_list.pb
Size 1.5MB
SHA256 ea1905d76f33466766952638fb8256371de0497745dddc6033d21afdb5636ee2
MD5 036bcca8f7e8a3105e0a3a436cbde952
SHA1 1a1c008b6ac4972b7f12806f8992ad282585d51e
SHA512 39c0599264c38ad779b89a99f63cf8a8a636adad69a1fd7cdf161bb1c709134ebf03cbc3234a9c9191cdae05c8e1b97721cb97eaecd8713a9c83dec243c72113
SSDEEP 12288:6OJPbs4HFDYV3tEmxyGrh9NFMWswBvLrN0PpKcgByP15M:3PvYGmxyGNFMW/TepKX
TLSH
T1D465B5B9DFC00185DBB8112D20BF71D8181416A180E9DFEAFE7C85CF2B8598977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fc98b26a4a99ab7a14a3f1cb5e26248338fae5e3f0b81a650e0b2e58c4884671
MD5 8d749c6b1ccd55fa454e42b4c4e0301d
SHA1 7af9de143a82b0615e9f6a8397f9e1f911c277b3
SHA512 56d6d8a8d4e9428e63deac8b0f76521d4e580c96256b09a835c2bcc43e444de5a4e34497b8dac263a595050f3bd7a2bf466f5f1713184f4ae042837395e48a92
TLSH
T12D4141D14C3D66D1D4BC0E6EA09B78FC82DCD725F4A4353D2868EA88063EA2D648043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b99fded6c879c2816dc390fa7373c48562732a06529e7f50dcccc932a8645e6a
MD5 60a79c30e6f984820ed6df04e0bbdf99
SHA1 f6a847f8c732d65788c3ecdea9e78335f480bd2b
SHA512 02b43a211c1d2cf980503a62fd2be6c08a2b5b994a5ace46f11c27d8a3c9230f1054150c0c8e220e38f9f91042ace6b3030f4e972a8a503fe88b4f14bbb2345f
TLSH
T13C5140D14C3D56D1D4BD0EAEA09B38FC92ECD626F4A4347D6864F9980A3EA1D748043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c24d645a1e55625545fe217f33b542a0c1bfc1f2e64677fa49b44996d2b3249e
MD5 5862c8b38cd7b2a09de8ac8243eb3535
SHA1 e1301aab2b92d9487f5025760e26c4f3880adf2f
SHA512 20af80005c8184cbff4b3126a199f446b947fb1df450644b1e4189ff798506ca59496922cdfb01187bcad50a0fc8eb24ef59d0ea3aae09836237decec6affca3
TLSH
T1654141D14C3D56D1D4BC0EAEA09B78FC82DCD625F4A4347D6824FA980A3AA1D648043F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1413689884\data.txt
Size 143KB
SHA256 4edfdb9cade0be665696dea609332ae299080986e7adee23432a7012f107851f
MD5 695d1e0603e2d8d001b7b604580bba26
SHA1 796e01101b9596a88c2e12ed2b7406d874df7c43
SHA512 91865dc3f65a7c722207fa8e1e442fb637c49b9d0160e885b58fd4afb2cdcddf0f8ca516c6a1d9aafa00ff8ce5b5a91f122f46dcba264e35753b8daf39d3749e
SSDEEP 3072:0PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEnGA3iqS5Wt8y:YX1aI5aZoKzMJ07NnGk1
TLSH
T1E5E3F150CA841F9CDFAC261C50FE0F1DB3D0C79D852B658AEB63BE4A6F4AA0457274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1413689884\manifest.json
Size 52B
SHA256 dcedd46fab398b40ecea0160d44a5140286672ecd6e70b7d63a675de3e0030e6
MD5 4100dc4a7cbcbfb95078f35006d88b85
SHA1 5ade230ac8f36d89b8ff3db7d7ed94175313b460
SHA512 ed02ff06ab9d94e287da52d034ff547094f073cb7e969f532840e0e8b91896f80e826264fd33b3a4bbe9c73fd085d4541265eebd11d56c83e21e8cdeea911708
TLSH
T11D900260042495571AC10E906574F8959391661A55850D1E0445154802D546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1603311058\manifest.json
Size 116B
SHA256 a1774d7a0ac3f90fe6fbed83045377b838af48811380d5ad88809222168c22eb
MD5 6658e8d6901ebdb2b695444e181b6348
SHA1 34c4bce8c106ad7c8ba03d56f702b868a9ae67ed
SHA512 615aa2777141a88f0d0904e7c73de3affadab0e7bff76fd11b98c8970f9b44fff5186bd4ca721c8960f1b57b4e35323826d52d5fc09d10a25b21b4ab46167d70
TLSH
T14FB09262A8084633689523F4A22383A3CBA86D4A91306606051B548165AA73B22E5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_35377165\manifest.json
Size 118B
SHA256 e7e12015c10d443af2d253d119a711fa062e97f5e17c328c3337a00a5c151933
MD5 a31e1922254394d30561180d05c0d7af
SHA1 86d0adb50316439e9517fdcc5e66283219885d70
SHA512 68318415536eb77f577012722ff396cffe17d51f8966ce95004c441f31d70f7ace7d305d6e964f4f7f435c2f0f9a5936daa096cfd8802c513e6cb2e6dd4dea9b
TLSH
T174B092B00C0AA43B22C09360ECA0A68683F80228F8061B6E088036481F8817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download