5ed8d4dead98d5c2af834e0a780ed6284dfa53eab87831b7603401a1945b9d13

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
txwdz264_down2.5.6.html
Size 5KB
Sample260626-pg6dmabs5s
SHA256 5ed8d4dead98d5c2af834e0a780ed6284dfa53eab87831b7603401a1945b9d13
MD5 8c80a8f2df0cc39e2ecae2f75ee4a50b
SHA1 a20062db378c0a8b7b897d9433efbb33341e1564
SHA512 dbc40a4e287d5eb0b026db1b1a5627dedf42aaaa0ad6bb1fcf0f95b3ed7103e7ec1562863ac4a9a83d2372a5436f16a4a2a359ba508ad5c7854807571676de12
SSDEEP 96:fjFj7jOjEDDK/D5DMFLzLexotNREeZNeBuX7RslvaQxvbbmKonx/ICM:fjFj7jOjEHK/VoPyCqeZyuX7qlCejbES
TLSH
T144C1B432BAB9113E20D3816331BDE30D3AB19153DB46488076BCC5795F8DF86A94B6C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3300	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269499905913061"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{A3974CDD-E231-4670-936C-44674847FC61}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5888	msedge.exe
5888	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 5368	3220	msedge.exe	89
PID 3220 wrote to memory of 3300	3220	msedge.exe	91
PID 3220 wrote to memory of 5436	3220	msedge.exe	92
PID 3220 wrote to memory of 5436	3220	msedge.exe	92
PID 3220 wrote to memory of 5436	3220	msedge.exe	92
PID 3220 wrote to memory of 5044	3220	msedge.exe	93
PID 3220 wrote to memory of 5044	3220	msedge.exe	93
PID 3220 wrote to memory of 5704	3220	msedge.exe	94
PID 3220 wrote to memory of 5704	3220	msedge.exe	94
PID 3220 wrote to memory of 5704	3220	msedge.exe	94
PID 3220 wrote to memory of 4752	3220	msedge.exe	95
PID 3220 wrote to memory of 4752	3220	msedge.exe	95
PID 3220 wrote to memory of 4752	3220	msedge.exe	95
PID 3220 wrote to memory of 2504	3220	msedge.exe	96
PID 3220 wrote to memory of 2504	3220	msedge.exe	96
PID 3220 wrote to memory of 1416	3220	msedge.exe	97
PID 3220 wrote to memory of 2504	3220	msedge.exe	96
PID 3220 wrote to memory of 1416	3220	msedge.exe	97
PID 3220 wrote to memory of 1416	3220	msedge.exe	97
PID 3220 wrote to memory of 1240	3220	msedge.exe	98
PID 3220 wrote to memory of 1240	3220	msedge.exe	98
PID 3220 wrote to memory of 1240	3220	msedge.exe	98
PID 3220 wrote to memory of 1288	3220	msedge.exe	99
PID 3220 wrote to memory of 1288	3220	msedge.exe	99
PID 3220 wrote to memory of 1288	3220	msedge.exe	99
PID 3220 wrote to memory of 5168	3220	msedge.exe	101
PID 3220 wrote to memory of 2484	3220	msedge.exe	102
PID 3220 wrote to memory of 5168	3220	msedge.exe	101
PID 3220 wrote to memory of 2484	3220	msedge.exe	102
PID 3220 wrote to memory of 5740	3220	msedge.exe	104
PID 3220 wrote to memory of 4452	3220	msedge.exe	108
PID 3220 wrote to memory of 2656	3220	msedge.exe	109
PID 3220 wrote to memory of 3788	3220	msedge.exe	110
PID 3220 wrote to memory of 2404	3220	msedge.exe	111
PID 3220 wrote to memory of 2404	3220	msedge.exe	111
PID 3220 wrote to memory of 5888	3220	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\txwdz264_down2.5.6.html
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2a8,0x7ffba302c188,0x7ffba302c194,0x7ffba302c1a0
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,7963863073515625788,11621702433978865137,524288 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,5248315062300897989,7292989463073381956,262144 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,11288560494489424068,17362536702354521983,524288 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:13
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,8308490058279753063,17744370583804975777,2097152 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,3659211652512849307,9451019706345282935,2097152 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,457195731625100254,9051540277986425107,2097152 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:9
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,1110540653392473301,183756564942809621,2097152 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5396,i,12883378855332604550,17376583624318114874,2097152 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5412,i,14125242996229910532,12844392056483763506,2097152 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,11898051253527933157,13982789950767194478,524288 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,16880219078986657877,4850728843088528035,524288 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,15846917766048077810,9598164255608747237,524288 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,15846917766048077810,9598164255608747237,524288 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,12443822997577068005,15271719957031943639,524288 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,3935534041781481127,12911159822456397959,524288 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,6749999937200154310,9461895982077209096,524288 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,13410578099637019688,13231364189136280023,524288 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6996,i,14145626403169809079,16867333952812143997,262144 --field-trial-handle=2324,i,18373729206011706573,5447740394559889164,262144 --variations-seed-version --mojo-platform-channel-handle=836 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

42c29b77-ba99-4118-8282-e4b376a9d916.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\42c29b77-ba99-4118-8282-e4b376a9d916.tmp
Size 14KB
SHA256 3a8b923807631857c99caf6b0af7816e15bc7f6afc8d9281a4cc2868d8c5a37f
MD5 de3b421cee13978b7c2c441ab7bc0b80
SHA1 8ae5091716eba6d6de1eef5d66efc6277a73699e
SHA512 a4a77dce593f7a694e23c809cc1b783f9316e493691d2889cc7c705b6737e7fd310ad7b933de2972f9f0c6de6e155610d1d235d91fbbf2754f13880d6cec55a2
SSDEEP 192:sxRHRQyM/jK1Ml8wFr/fqsfqwNkUd+zoA8p4h/g6+WNIYZjXG2wIgD3J:sxRHebr/fqsyw7No/5Ibl
TLSH
T1FF52E916A624593BDCDBD209FA517F53D6F81473E2940E44AAFCCA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2341b0d10b4284d0eae21c2cb6032097571acab0da4ccf57a17c3c572cf30292
MD5 fb7dcf4c886e0ef145db735a6d533fa8
SHA1 1e69170ffefe779ba23cf52e0671080f284093b5
SHA512 b3fedb6fddc746d713fad6d8b7bc1ac5bca85eb0e234e01d4d7af8259ca45544df474e064032f23a30f148c5a5aefb6bca567da8080ef8d070c87fbda51a056f
TLSH
T1DA61B691B061CCACDB6040F3C2F21BA47BBCC6DE460BBE2BC39C6879F919B5C9441691
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594cce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594cce.TMP
Size 3KB
SHA256 305bc08fe03152438d2bee88e7b9d0b93c0ebd88350b8916f319a3e0d36d0458
MD5 edc6dd4fd229e08dcba8cee1a0dafaea
SHA1 b492b481bf3052bcbc2873c6675e37df91a615b7
SHA512 7d5dc39ca7957c738ad4c3e68231c0820e9849802935edd339270896fad20488dd6522a338d971d37ba8b5c91a2097211e805d2a013a5e0fbe34fb329d998c3c
TLSH
T1A261A681B061CCACDB6140F3C2F11BA47BBCC6DE454BBE2BC39C6879F95AB5C9441691
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 aca0841329beb0e2028c77e67affa606784381961d5d8a767e1ae65655e23a68
MD5 f22c37f3230e5619640c8712f89dbd98
SHA1 65e234f1167ea90d903fcd7ceb21adc07f9593a5
SHA512 68d0d1aa4ac3b5940ef172b24706763c30d3f1c46b18e8d610b6c3ce9f3f16c2f07ec540196595a4c32469bae0873912bd6de143690f94e4c9d0bbe8389ea732
TLSH
T1CA51ADF7C2E8866D891156F4AB257E2BCE2D0915432C3C5A89E4EF0F63E2470D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f817ea1e5d27a2f653a99f8d1d9731f0db86e23d63a2e340a04e3d76353479dc
MD5 fd9d70204cd72da5bfb29d7076a9d6a9
SHA1 f36562c5fd497b9f145f59234a8ac7e172e8b095
SHA512 e9394b8eed83842d2f8f8bc89f78da9959277a205d9d4e21e29482fabe2a470224c682bb4e62d32c9fe7c1c865e61eb1a968d3fa49560b63ffe91b46a142321c
SSDEEP 192:sxRkRQyM/jK1Ml8wFr/fqsAqwNkUd+zoA8p4h/g6+WNIYZjXG2wIgIJ:sxRkebr/fqsLw7No/5Ibs
TLSH
T1B452E9156624993BDCDBD219FA517F53D6F81573E2940E44AAFCCA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bd57eeb40b8ad77fdc20485c3c932df93cd5518c2613ed12e66a707ae260eed1
MD5 d6736502b2097dfc3a91fb73d7884946
SHA1 b4189db36f9152caa52180afaece0e34e1188ecd
SHA512 34c992148187a98b3186cb2c603c1ba64482c1fdf9e73a28576d232a670b1374e12c3d4616bf805cdbcffc68d5c5f6646bf7dc8ba23d13b2e43a4941aa2c60da
SSDEEP 192:sxRHRQyM/jK1Ml8UQhFr/fqsfqqNkUd+zoA8peh/g6+WNIYZXXG2wIgDJJ:sxRHeqnr/fqsyq7Nq/5IBf
TLSH
T1A562E916A624997BDCDBD219F6517F53D6F85473E2940E44AAFCCA0C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f989bb37f69f45aa942ab9c9d08df1d4f1adc31fbf6e3d0f4583400c1eff97f7
MD5 9e51631743ece307bb8603241e365187
SHA1 81da4622a082c8811dd3e049a75b76f4db560f26
SHA512 3c2980945e70f0cef62801ea3fa1d5db69e7143bfa98a18885c9a0943bc4429ad5753bc72f23fb5d1bcf19dee1e1901228a384fea420462cf96bb379de122566
SSDEEP 768:eOEt7IWgKgf/68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EkTqQyro7ov8nSl:eOEt7IWgKgf/6u1jaZ/Qp88Sl
TLSH
T16DC20B2B240CC77E4F800E5DAC2ABE976DD801CB9B988D4447EA890C03C77EF521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a04f395c-6a38-4761-8655-f23dc61b52fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a04f395c-6a38-4761-8655-f23dc61b52fb.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8571cf98-9310-4734-97e2-fb4b884c1280.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8571cf98-9310-4734-97e2-fb4b884c1280.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0b3cc6f28da6c4671105e1876d3f107c6bdeb4e14b134d52ca3bf7d172687b09
MD5 59097e01a9ad032bb7e8c4dcd22b2d91
SHA1 36b6b7c2fe7c245630487a8be16b592aaa54caf8
SHA512 e9d8727771e75aa108f12a8f0763752393f4fc71da74d8aeea884621da17051f96f6ebbaf5fda4a2e6ff019ce58def808031be5a3a31f9d4a6394d255260e9fa
SSDEEP 768:ij+9Z3WMhLPfcOafu8fiQqV5R4HTytYYqgHvPwdzn12bfI:R9Z3W6fefBfiVWTwJYByI
TLSH
T175F2AE71EDA84D6B1DE2CAC57602374B7EE88227D3C42660D5DC5E0D05DFA9D170B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4b41b7c882b379ca3e53c9b632abc51a31180bbed83cb5f31c7a2c629aa91071
MD5 50a1d9941c13e67552a8e551dbbb1916
SHA1 eaa8d33ff411fa0d55429e6d000f8265fa982d06
SHA512 dfdbee249b1e0efbd908456cba8714e2ec601b446317a97e88f3904d073ae00aff615c312746072df66b70e443dde47ea6b8f29dc5e29564e5562aeb358e5029
SSDEEP 768:sjaeqD4MlshiLdMmD3jMsLPfcOafu8fiQbV5R4HTytYYqgHvPwdRh9TX:sqcjhIdMs3jZfefBfiUWTwJYHx
TLSH
T1DA03BEB1ECB85CAB5CB6C581B20336977EB48267C3C53B64D9D85A0D069F6DE130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cf3981c6c9271afc80bbff7b5173cd1a1f644823fbcbe9c488c19822387971bd
MD5 9f0bd783d8f630eb2c74f74cec92e9b2
SHA1 0d342efa0ed6907b7ce7bdb50ce00b8dfb7a9fce
SHA512 896aeab41dc0b33f9181b913dd79fc0f4caddce80c47ebd2b1f5c05568b4ecd179789c1325e1cc113bbcb3d49f27c0620d1aaf2a80c8d9f4477e951fd850ea2b
SSDEEP 768:zj+9Z3jMhLPfcOafu8fiQqV5R4HTytYYqgHvPwdzn12bfI:W9Z3j6fefBfiVWTwJYByI
TLSH
T1EEF2AE72EDA84D6B1DE2CAC57602378B7EE88223D3C42660D9DC5E0D05DFADD130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 ce60277a2f4721593c3a0fb83f8e192a9c3d7232059bb15d843772940fbab054
MD5 5fec6a6f683af834ae364de0e198873c
SHA1 8b1a88dcce2847420068d5a83747360f4528a91c
SHA512 af50ddf409ba82d54beb4f186863fbaa216345e9d05e9886ade2ed96c652cf8dffead55078b244aa3f1fb1f6607b1ef440a297ca85a1931113da8707918e4082
SSDEEP 768:dF1j+9s33wg+MhLPfcOafu8fiQ5V5R4HTytYYqgHvPwdzn12bfI:09s386fefBfisWTwJYByI
TLSH
T1DD03AE72DCA88D6B6DE2CAC5B606324BBEF48267D2C56660D6DC4E0D01DBADD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 065f9e7c3f449e5be0814a1c175819824d06ed48aeda24b9103755114cb977eb
MD5 aa2508bdd4fdcffa48aa005283e9969d
SHA1 11fbdd4bbadb2f422ec712b4ff537b3c59587607
SHA512 8744c4b22b0827e9919f6c19c434200cc7435c3d9df2303d10ba796128e9c84c60903a746f8af7a86f97146b5095076d4910a592491c70966507b76f63663c7f
SSDEEP 768:EjaeqD4MlshiLdMma3gePfcOafuxV5R4HTytYYqgHvPgxyjWtxjTo:EqcjhIdMh3dfefwWTwJ4yj2y
TLSH
T13803CF7AECB84CBB9CB28581770277976EB842A3C3C52B64D9DC5A0D019B6DF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb164467-a343-4565-ab36-4ea54aa173ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bb164467-a343-4565-ab36-4ea54aa173ef.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download