hxxp://tpwd[.]texas[.]gov/?utm_campaign=fishtx&utm_medium=email&utm_source=june2026/1/0100019f006706fb-408da514-4ba1-4fe2-9d5a-10e543fa0491-000000/OD9JeBTlmlqJw2srk6oxiq_mkERD8vSvVW-jQzjvsL0=452

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/06/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tpwd.texas.gov/?utm_campaign=fishtx&utm_medium=email&utm_source=june2026/1/0100019f006706fb-408da514-4ba1-4fe2-9d5a-10e543fa0491-000000/OD9JeBTlmlqJw2srk6oxiq_mkERD8vSvVW-jQzjvsL0=452
Sample260626-e1wcnagy41

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2128	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269215093569160"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{B9DC0624-199C-439B-A8CC-3A4A85361608}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 2036	4972	msedge.exe	81
PID 4972 wrote to memory of 2128	4972	msedge.exe	82
PID 4972 wrote to memory of 1100	4972	msedge.exe	83
PID 4972 wrote to memory of 1100	4972	msedge.exe	83
PID 4972 wrote to memory of 1100	4972	msedge.exe	83
PID 4972 wrote to memory of 3612	4972	msedge.exe	84
PID 4972 wrote to memory of 3612	4972	msedge.exe	84
PID 4972 wrote to memory of 1864	4972	msedge.exe	86
PID 4972 wrote to memory of 1864	4972	msedge.exe	86
PID 4972 wrote to memory of 1864	4972	msedge.exe	86
PID 4972 wrote to memory of 4016	4972	msedge.exe	87
PID 4972 wrote to memory of 4016	4972	msedge.exe	87
PID 4972 wrote to memory of 4016	4972	msedge.exe	87
PID 4972 wrote to memory of 2024	4972	msedge.exe	89
PID 4972 wrote to memory of 2024	4972	msedge.exe	89
PID 4972 wrote to memory of 2024	4972	msedge.exe	89
PID 4972 wrote to memory of 4524	4972	msedge.exe	90
PID 4972 wrote to memory of 4524	4972	msedge.exe	90
PID 4972 wrote to memory of 4524	4972	msedge.exe	90
PID 4972 wrote to memory of 2696	4972	msedge.exe	91
PID 4972 wrote to memory of 2056	4972	msedge.exe	92
PID 4972 wrote to memory of 2696	4972	msedge.exe	91
PID 4972 wrote to memory of 2696	4972	msedge.exe	91
PID 4972 wrote to memory of 2056	4972	msedge.exe	92
PID 4972 wrote to memory of 2056	4972	msedge.exe	92
PID 4972 wrote to memory of 4236	4972	msedge.exe	95
PID 4972 wrote to memory of 4236	4972	msedge.exe	95
PID 4972 wrote to memory of 4236	4972	msedge.exe	95
PID 4972 wrote to memory of 1412	4972	msedge.exe	96
PID 4972 wrote to memory of 1680	4972	msedge.exe	97
PID 4972 wrote to memory of 1412	4972	msedge.exe	96
PID 4972 wrote to memory of 1680	4972	msedge.exe	97
PID 4972 wrote to memory of 1668	4972	msedge.exe	98
PID 1668 wrote to memory of 1452	1668	msedge.exe	99
PID 4972 wrote to memory of 4856	4972	msedge.exe	101
PID 4972 wrote to memory of 2060	4972	msedge.exe	102
PID 4972 wrote to memory of 908	4972	msedge.exe	103
PID 4972 wrote to memory of 4976	4972	msedge.exe	104
PID 4972 wrote to memory of 2844	4972	msedge.exe	105
PID 4972 wrote to memory of 2844	4972	msedge.exe	105
PID 4972 wrote to memory of 5104	4972	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tpwd.texas.gov/?utm_campaign=fishtx&utm_medium=email&utm_source=june2026/1/0100019f006706fb-408da514-4ba1-4fe2-9d5a-10e543fa0491-000000/OD9JeBTlmlqJw2srk6oxiq_mkERD8vSvVW-jQzjvsL0=452
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ffbc7d9c188,0x7ffbc7d9c194,0x7ffbc7d9c1a0
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,540108217747266489,13381358202859529477,524288 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,2645322529355475589,6582429458984320860,262144 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,16954795344998021899,15824225389007960014,524288 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:13
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,6165614522514011033,17570820356975531133,2097152 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,10749961229492178285,4997316074424999728,2097152 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,12222377141615208597,8019409803716044864,2097152 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,14962149760447753202,11102313709690159494,2097152 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4400,i,2265497662562323232,11168426212776317799,2097152 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4428,i,5032272446000250161,11335327238367477714,2097152 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3472,i,4059499480452113826,13938673927622528174,2097152 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,9805342381923549765,5884254904033013863,524288 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:14
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,7601733532518016969,11185510533305786528,524288 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:14
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,84517915799583174,2823212891676254796,524288 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,14320527709177360637,5285725032336860087,524288 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,14320527709177360637,5285725032336860087,524288 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,8922468756649262939,12419340314022746896,524288 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,9587495228464036294,8155333996544123820,524288 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,5169955285751090553,7719027789496562770,524288 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,4980572313958376192,3575124573909723927,524288 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6400,i,7369488696956689573,13853699286659606770,262144 --field-trial-handle=2108,i,17344695911696522468,14417782984138973224,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9268c81dd8afa6fbdc34d051a638b4dce94ab92618da951ddb0bc7dc51433fef
MD5 861a6fce0d87692d2b4a1303e56f1a25
SHA1 7a516cdc72a0f568ccf931e78fc08ead146d8e52
SHA512 9a9d6e902af9bba26e1ef6ceb054ca9a19ea9e7ea145a221d8fbe629d7b20cfc76340fd3acdcccde9af66986da13da0c4d8c84cd8ce7106f1212135992e9ce44
TLSH
T166D02B21B7CCD400C0E30031C018931041A800C4642B8944B0B0842D680B030B3CC047
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 adf1ac7ef6ad2f467814611b23b5905d27bfbc301c113cc0f42faa887b0cf867
MD5 43cfaffeaf5c46b9eadeebb1347c22e7
SHA1 d96f3ed6add4b5fd08b00be076bd99ac8c96b6d9
SHA512 d9c942c219d1021105ade146c164fb4fff35ac9acd0e85af945085e82c7ecd2ab6e92dbb4acf30d22ebeb0b2a7a9788fcf0f1d01f75408a2ec7523fc3c62a603
TLSH
T1C7D02B2177CCD800C0E30031C018931041A800C4642BCA45B0B0842D580B030B3CC047
MD5 SHA1 SHA512 TLSH

Submit Download

7e00c180-9c06-4805-b4e0-201a471f2399.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e00c180-9c06-4805-b4e0-201a471f2399.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6e2b123d10a7aac0ac803223d27c452704bcf845d0154299bfcd97e2d84b272b
MD5 30d2e104540473dd880e3465702675ec
SHA1 3f84ee454d96b4242226d811138d04844eaac860
SHA512 01ed03657bff958988b60527c7e74bbc84790096a65daa31839634d13a30d1f329be18810569614764fa42a4d6653fce24decadc29744c358362972e99076a57
TLSH
T150711F5D76E25AB3EB613B30DCE020187E77BBDA04434E06127C087E595F33946AE768
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5865ba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5865ba.TMP
Size 3KB
SHA256 76f88b127fe1cfef615405adbe0ac52f22e646e70738ea06e89a3e8b7cbe92e2
MD5 4abffbf235c5e0a5af6139f7cd82e44b
SHA1 079453f2f3dce2074a456fb50aab3de1e6eb8018
SHA512 8bfb31b8ec2f267f5fe4f547813712c05d4ebdfc447c5d58e8b792d4b9ab2837f2ea6bb0a75450b489bc34077298ee48a44e6a3caec605fcbe0de85682976dac
TLSH
T18C615F9D22E249B3FB613630ECD021047D73BBEA08434D0612BC58BE199F735821E368
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 62d972b4fe58f5df5bb8021ab0db8cfa475eac6d59a190e56cf60da6317b33d4
MD5 24fef2d5cea5f8daf520a86a11adf695
SHA1 8bd1a0fa05547e95a9dfbb1b59563a290160ce49
SHA512 ceaf45084112eaacc85442e34db11998590c53e34d6df4f517ba61c871e3441a8f92113f917bb49a46680c5cb81646f7848447a252be3f109a4d174ba29dfa69
TLSH
T132814DF6C3FA861DD82162F0AA18AA17CE5E092493383D6598E4AF5B67D2071D34174E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d978da08cbf4b6c0c31de38045b625cd1e25ddf37a94a93b395e5956b964f4df
MD5 fb3f4d317ba19ca90046de1dc9a0f0e4
SHA1 67e122de6d145b9863f9306a974db088efcd907f
SHA512 7fe8aeb2aea29171c09c52ccc21a021276e52c8f6822aa9be9fd1899a6ad77c17905b4e6ff33e2325962b783ab32eb3f38159f5b78571afebd55393bbf08e3a7
SSDEEP 192:sxZTNlRlyM/jK1Ml8MFOP/fudsHIkPVHCIdpz7/W6+WNewe/Y0YNpFZKiIgrJ:sxZT79d4/fYstPlv/b8/5W59
TLSH
T10052E9126A345977CCDBD209FA55BF53D6F91572A2900E48A9FCCA0C04EAAED2307C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9c8b9ae350566d28e4c478bdb145d3e322b775a02a6a51830cb0be831826c620
MD5 dce0a279b91c4a81a1e56c15f291492e
SHA1 dfa078cfe66de0b80e54c4d0abd6228d8e14e852
SHA512 55cb93d7e2371b82fc29786d894fefb1d39fb14824230cd50ce147fb09fd38a3d8853010156c850be0a2d5130eb0f8fee473cd14be8e1bb6f28911acc487f606
SSDEEP 192:sxZTNlRlyM/jK1Ml8UQ0FOP/fudsHIkmVHCIdpV7/W6+WNeh+XY0YUaeKiIg59J:sxZT7/qC4/fYstmll/bxX5rt
TLSH
T16452E716AA345977CCDBD209BA45BF53D6F51572A2900E48A9FCCE0C04EAAED2307C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 21a109157fa981bbb3240725b189e4f627d19735f0cc0b4d150c2e149f0e9964
MD5 2da5754dc5d39c4da69450d3ad0b0650
SHA1 678a752ffb591370961ea7f68a9e675866f2383f
SHA512 57b0ced2151613c53dd1773d50c9812ffce81359f2d7e9345fe2d141d8824a18017d44f1916c66a7c9db401851888e6e2fc5bd9354c1dc9eae8615ef1e6bc0f4
SSDEEP 192:sxZTNlRlyM/jK1Ml8MFOP/fudsHIkmVHCIdpz7/W6+WNeh+XY0Y4FZKiIg59J:sxZT7/d4/fYstmlv/bxX5dt
TLSH
T15F52D812AA345977CCDBD209BA45BF53D6F51572A2940E48AAFCCA0C05EABDD2307C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 f497f5fe8d7849e08331497892b88102a68b018db2a0dfcbe4c6a18b184e05b4
MD5 38990df45113741e3cdac5c2dc2f93f1
SHA1 f2776c79b233bd0c8b73462eda4353a44187b8d6
SHA512 6d00440352b7b685c4897d23df821fc34c566fa0eacee541f8100d1ca88aa38c6a72013c3a77a6353a3e78a1b756e566bb70db30e2edab58183d2a91b412d69e
SSDEEP 768:j8l1j83r2pmWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33ALl/C80/Mkroc5:j8l1j83r2pmWRmeKQBCu1jaK3ALpCN/z
TLSH
T19CE22C3B740CCB7E4F844EADEC266F966DD801CBAA684D5447FA494C03C73EB511A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dce0056983abd87602aad62e5fd30de2b08e3e5a71a05047fbff887d7ba4f564
MD5 2d2f8ce4cc28df335b8a10f1995c8dc9
SHA1 7950b30902966728472515e0fe168f54ad093db8
SHA512 17ff703fb0e686fcdab13f25b641c4b64c365f2144023786297a49e923da1ece3e0782e55202103edac25d5146feefd178916902c062e516ba2699aff379df97
SSDEEP 48:KkUIHKtecXyuWRGw9EAuK+gqCrzInYgKA1YWg0owpb2QtyF/IpKQoc3:KkUgKtem9WRJrKKs8ee/eKQoQ
TLSH
T17591995331B713473C3E7848A6D4871A174672633128A5AB3BB984B14E2BE344EFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58e654.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58e654.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d502ac67fb37d4b6ce3e3aeed36d86fe2ec61eecdffc4341bf5649256cf21d6b
MD5 a56632e728c27c3af2406e2176932c9b
SHA1 f3289daa0edd08bd51ce46a26fc68c6f42ccf58a
SHA512 f276398e6a7b3537ee7cd758e75d4af35d6496d7c23037fe24074f0bf246797c0df6f088ea5023db3c750e12534cd39df6bbc6ac374fc7127e1f342ad4cc20c7
SSDEEP 384:DxtNn/s3n9Sf8NrVCn/0YRcBTgX532oOIVEJrdqmn15wbAjEu/:Dxj+9UVnMYIkdOIOhdqmn12bfQ
TLSH
T186927C32A9789D331EA399C9F546361B6FB84077D2C82E98C1EC9F0D05DA7DC131AE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 720c7fdcc4107f0a2f5a77e0d4958509cfae70c19e74f5e9c52eb2afd56b9abc
MD5 0203d2ce7a3915569f6d9cdae4a05205
SHA1 e6b0e9dddde2126703adf0812cdec9f848200400
SHA512 e3f37d7e6048e40d8c47f33b0417a4a4e0bde66e8efd00232f2563577259e8f61c7530f5587ae53fb575d7b60db0d9b89503f5366e74ae7a4e61b4637f026ece
SSDEEP 384:pNiF1tNn/s3n9Sa8N18TUNTUlIlCCn/0YRckTgX532oOIVEJrAqmn15wbAjEu/:pEF1j+9fcwgxnMYxkdOIOhAqmn12bfQ
TLSH
T131C22AF249D78936D9AE4B87B77D2D065EBCC067B1842954B3985A0CCC9A2BFC309D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3c19ff6e5776902e9de707fac879d3434c50784ff851f9d4eb5a3f54e7f37af1
MD5 3ee394df4c4ceee79fb4d74f45fcbfad
SHA1 0b8d64484bcba0f910a16fe08155ca84fcac8a56
SHA512 a21679f61e47cef6ad991faf5831dbd6b348b16d45e8c846dfa90bb36d2695c0558b9c0350e00ef298b6ead855933f13e95f024218f5ffd48ef2f150fc55d64f
SSDEEP 384:BxtNn/s3n9Sf8NrCCn/0YRcBTgX532oOIVEJrdqmn15wbAjEu/:Bxj+9UEnMYIkdOIOhdqmn12bfQ
TLSH
T108927C32A9789D331EA399C9F546361B6FB84077D2C82E98C1EC9F0D05DA7DC131AE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a3654caa4c5bcfcf534068555abc6c8f0f888cc7c0fbca12a76483b604ef5d84
MD5 a0e492448312c91249aea9605a477d4f
SHA1 a48f3d39fad740b7764509608303e41bdea2053e
SHA512 f164b3863cc3bef6da9c168143ccb9323a5b066af84db7acb8a89c002815ca33051f417fbdd46ea145951694d08343cfc1e52efd73e8b27c1d80247d1b4f74bb
SSDEEP 192:6GNr6i5fQmiUyVIdVRO7X5zPr2oOA4mGajEsGBgU6:6GNr62hBBO7X532oOAgBgU6
TLSH
T1CA02D835B9686C778FA3AD45B58637175FE8102BDA946F84CAE81B1C00C769C1306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e40ff6c22cbb21493381fbaa49c82f8541ac9a751b5d8ac09a7e9d981dc354c
MD5 26693aac506dea8b0203fefcc2ff6982
SHA1 1ea40accbc670c0ee7bb826feb3b29b677d94dab
SHA512 adc3c24c230ad3a0775ab11c939f1f718a7b800f36f0a4dd9473d34efbcbfb8d8ccc4e9e38cc1c308a339e8234f7f4507e713b1cde8357a0881ceef6e93eda5b
SSDEEP 192:jBGNne6i58KQmiUyVkVRjd7X5zPr2oOA4m9V1SJrCGQEkqTU6:9GNe62R7B7X532oOIVEJrMqU6
TLSH
T1DD12F931A9A8EC275E93A585F48736175FA81127DB887F84C1DD2E1C05DFA9C130ED27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b676e45-998a-4547-9ba1-50661b532575.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2b676e45-998a-4547-9ba1-50661b532575.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download