hxxp://workforcenow[.]adp[.]com

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://workforcenow.adp.com
Sample260629-smb9hsgv21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2284	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272205088703954"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{16629776-2968-4333-A189-0F5EB3FE8EE7}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{8CCEE12C-CFC5-4F20-993A-B6315CDB6D1F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
392	msedge.exe
392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2716	1116	msedge.exe	85
PID 1116 wrote to memory of 2284	1116	msedge.exe	86
PID 1116 wrote to memory of 2384	1116	msedge.exe	87
PID 1116 wrote to memory of 2384	1116	msedge.exe	87
PID 1116 wrote to memory of 2384	1116	msedge.exe	87
PID 1116 wrote to memory of 5052	1116	msedge.exe	88
PID 1116 wrote to memory of 5052	1116	msedge.exe	88
PID 1116 wrote to memory of 2996	1116	msedge.exe	90
PID 1116 wrote to memory of 2996	1116	msedge.exe	90
PID 1116 wrote to memory of 2996	1116	msedge.exe	90
PID 1116 wrote to memory of 3336	1116	msedge.exe	91
PID 1116 wrote to memory of 3336	1116	msedge.exe	91
PID 1116 wrote to memory of 3336	1116	msedge.exe	91
PID 1116 wrote to memory of 4132	1116	msedge.exe	92
PID 1116 wrote to memory of 4256	1116	msedge.exe	93
PID 1116 wrote to memory of 4132	1116	msedge.exe	92
PID 1116 wrote to memory of 4132	1116	msedge.exe	92
PID 1116 wrote to memory of 4256	1116	msedge.exe	93
PID 1116 wrote to memory of 4256	1116	msedge.exe	93
PID 1116 wrote to memory of 4212	1116	msedge.exe	97
PID 1116 wrote to memory of 4212	1116	msedge.exe	97
PID 1116 wrote to memory of 4212	1116	msedge.exe	97
PID 1116 wrote to memory of 4020	1116	msedge.exe	98
PID 1116 wrote to memory of 2356	1116	msedge.exe	99
PID 1116 wrote to memory of 4020	1116	msedge.exe	98
PID 1116 wrote to memory of 2356	1116	msedge.exe	99
PID 1116 wrote to memory of 5004	1116	msedge.exe	101
PID 1116 wrote to memory of 2052	1116	msedge.exe	102
PID 1116 wrote to memory of 2052	1116	msedge.exe	102
PID 1116 wrote to memory of 2052	1116	msedge.exe	102
PID 1116 wrote to memory of 744	1116	msedge.exe	104
PID 1116 wrote to memory of 3748	1116	msedge.exe	103
PID 1116 wrote to memory of 3748	1116	msedge.exe	103
PID 1116 wrote to memory of 468	1116	msedge.exe	107
PID 1116 wrote to memory of 4996	1116	msedge.exe	108
PID 1116 wrote to memory of 1572	1116	msedge.exe	109
PID 1116 wrote to memory of 4600	1116	msedge.exe	116
PID 1116 wrote to memory of 4600	1116	msedge.exe	116
PID 1116 wrote to memory of 392	1116	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://workforcenow.adp.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffc0125c188,0x7ffc0125c194,0x7ffc0125c1a0
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,11036248435117428966,2538727144204847732,524288 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,15343032063453974076,2926011546860276634,262144 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,10722805889259164621,13122604810759726978,524288 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,861682956414393945,6890100306356545845,2097152 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,16346232196463570461,17255338117874990619,2097152 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,10999604968566679895,8710610785815705125,2097152 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,7462270116617391715,12713043905490652365,2097152 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5048,i,10309491927459801498,15362164178931245281,2097152 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,9562197130108807837,7131224844950602876,524288 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,1592813959281263775,15823970226425844480,524288 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,17606347333547294659,12210901690297182977,524288 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,17606347333547294659,12210901690297182977,524288 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6340,i,7407004010807068475,10713285148203562344,2097152 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,3146887297845821438,9171279273152324296,524288 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,18095946227722102445,3402303648969113445,524288 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  - Modifies registry class
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,13443429314944317364,99189719857211997,524288 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,13956061405519391934,17651675209088338035,524288 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,11488554616422294784,3342186281841419086,524288 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,12825641408503314963,7839692869131991632,524288 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6400,i,17671988102800815080,5505926328293249045,262144 --field-trial-handle=2080,i,8059499074001159560,7968469159163105233,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 e0a80fa305966ef39049a572f7dee7153dfa5b789ae58bb10144a6c911f9c0de
MD5 0783d0472361fbf0ae1bc87454607932
SHA1 e05340eda9767a8318b302338bcddbd4e5cbf2a2
SHA512 88873e13efea1f7e77e7f4a5cd7afeb401ad8096a1f5956d5a3d648027def793c768a9b11be4aa7b2ea5fbb335d577b4156d36d912407b057d57764eb86d06b9
SSDEEP 96:WI7H435Zp5a33RKk1RExLdmDWTisH+nubYgsXClhu0fZBuVAsVbwgjN0cj/2gNeQ:WI7H435Zp5a33RKk1RILdmDEiU+nyYge
TLSH
T193A191B05D9BC563F753C13018CBB6A13372A7EAFC972E87A3D24B3412857A9F15A020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589fd5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589fd5.TMP
Size 3KB
SHA256 aced1887a5aa089b7f7d48830da38f01c9ae3feb61e6ad4f12647077cf823609
MD5 47631b18170b75f63291b139234da222
SHA1 7656477d3bf1b092e082b515a06ef6c568911e89
SHA512 06878b652e68fd49dd739dc6a9d7e7423a437c33278ffea5a341f30ccedeba97eb2c6d5d066b50677d29defb42cb82938f3efb13fb4adf5ab15d2b3026215cd3
TLSH
T102713CB04EDB0663FB60803168E332667731B7FAFC075E9902E24B302795761F45A024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_online.adp.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3abbf873b63e5fa5306980b91bf2f0eb97a08dc38cf043dee81c7295a38cf2ce
MD5 a9f9fb6ca5b963fbc4891f6bef0b0bc7
SHA1 160ae69710683df1282112e50fbe9fc9da32cff3
SHA512 82a496bf68ecd1c23aafcce0e81524debe229aaf6bd2377fc69a5b657c24609180a3d70a5ff1efcff0288d8e53a943d2434090ee5f6748a16ce0498e914d5990
TLSH
T1E44188F783E1496E9A1156F0AA14EF1FCE1C0513436C390989D4AF2BE3F30B1E011A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d50909b32e255f65ec2c20e7f8ea73673fa8d51337bc39be6fd80fef9b4e755c
MD5 213e95e0105884deedeb1dcbf9b3fed6
SHA1 63bbc3a2e7b4a539d3c42d20aec644521b2c1099
SHA512 bcc53712d797e6bd63e810138bd97273e1683381e0244cc8ad1d1120b6d94c49aee3deebf04778f807d9181faad62d15b0d769aad42f2cfc5b2c42e4895caa12
SSDEEP 192:sxZPRKyM/jK1Ml8Mk6/fIssXJHIdpbUHW6+WN5Hc/YIvrlbaeIgrJ:sxZPMM6/fIss5IQHbu/HZ9
TLSH
T14352E9126A345977CCDBD209FA45BF53D6F5047292941E88A9FCCA0C05E7AED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4af1eaee5cfdff28f90c6e074d8bb9d292e53e971b91cb302089074e68d28c63
MD5 4fb94a9c61c9738c36441865212b3510
SHA1 df04267803d0945fa135d9902ba6520de8249ddb
SHA512 bee942d3551cc69012661f855c189c416d7f0726b2e6018b29cbf8783ffcfe440dfdb333c6f50bf3ea7a24537cc4ad889a6b62ad9c1eaf646c52292041c04b30
SSDEEP 192:sxZPRKyM/jK1Ml8UQDk6/fIsLQJHIdplUHW6+WN5Hc/YIRkmloaeIg55J:sxZPMqo6/fIsLsI6Hbu/v/kJ
TLSH
T1B352D9166A345977CCDBD209FA45BF53D6F5047292901E84A9FCCA0C05E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 38e0e59a4e4f5293cc81c309007f7244a5ec2750939f7015d86c85bb54d2e98f
MD5 55a27e547dae2ace8b387e482cc5b004
SHA1 2259fe1ebb7a5b86ce1b6cfafbbcd9580ed881ff
SHA512 fe9013f9d09e77e7ff94e7a1ec100f2116a9e6641a661fe76062e0c68fa269eaaadc510f8e314df5eb4b3eba4608dba6522ff46aad5d0a676e48aa087cbb2124
SSDEEP 768:zrsqxXlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9Aro/4eo:zrsqxXlWvJD0Tu1ja54LAs9L/4T
TLSH
T1A0E20B3B694CC77E4F840E5DEC26AFD66ED801CB67988D5447FA880C03CB6EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 4f11245d90ac1898bda10a1e53cf1d64d5c0b5aa000802ec42ccf02d589b168c
MD5 e4892d964c9ebd594f1b6950ab35321d
SHA1 f4bc559cb5d8a2617b5b931fcd851c7fdefb320e
SHA512 655796062b93a32ffdc6fa4d8a68b3cad63a9cc17207b4b9263f0b882724674d42c0be31b2964c350ca5a8ffc8ebce0336c2079e9b5d5e3cf54672d879e32e9b
SSDEEP 96:KYbaKYIK+P6Ko8uutGKuIRJKKqQaCMwKZ2Z:ExZBdPxzS
TLSH
T1BAE16B42713B820238BE690CA27695374E8373A77559A56F7F7870B20E66E110EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

9e90551b-d38e-4de6-8b7a-27d8ed088462.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9e90551b-d38e-4de6-8b7a-27d8ed088462.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0dfe3ca0952ec03a35a6f6096c1842e0f91cc3609866995e46c4e29335579b17
MD5 80658af077f6d3a5a42e44781fc5feba
SHA1 80fb32ec4a1a1fea8545d8d86ade7e4cda763022
SHA512 9e0bff20dce7efa76bc5d7f1671d2c191dcbb225eb3f316a154d3e5aaf63623caef6282989003a2759459dd2fe087313a295bad8f3ca3b403b2e6443a640af6b
SSDEEP 384:itNn/s3n9SfsNIChu6bMEBVRNVOK+t9FRJmn15wbAjEJyyv:ij+9UbOnHVOKs9PJmn12bfJXv
TLSH
T13B927C329C380C775EA29549F54B36179FB880B7A6C42A94D4EC4F0D06EF79C231AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4fefe3034fd0c01e1e5da033fc00c41e69896ded681e2b1abcf1d2769f80a945
MD5 e2864e012ffbbaf872ce45645cea3757
SHA1 01083d44cdd4a7a6117a8dbd23004935b0b9207a
SHA512 b3865b2d1f3e212e1d2f48dcf0e96dc56f147a94385e9f66e5a596851781b9cb222729b7cf3d9c8334f52c50cd0d76240046ad2f10117d295655234a34e300d9
SSDEEP 384:6iF1tNn/s3n9S3zsN48TUNTUlIlnhu6bMiBVRNVOK+t9FIJmn15wbAjEJyyv:xF1j+94Nwgu8nHVOKs92Jmn12bfJXv
TLSH
T1DAC229F248D74836DDAE4B47A77E2E078EBCC067B5842950B3984A0CCD9B2BFD306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b5801c096a68cf25cdbdbc5a9dada28b381deb0550f178b36eb3e9f0c483d41e
MD5 c2b9fb8ad96262607a898924124c3be1
SHA1 56fbe0b0e0668b03735bf3557ba7069b47099ca8
SHA512 d66b67a2dbce49b0cf21383409c2093ee736051f9b10a9add2f90ba32a9697be3e124bf9264ea7823fd1502003c25341f2d7defceefdd13440ebe79b2565730f
SSDEEP 192:tONc6JkRtQmiUyDhW+RNVOmSY+y9h3EReU6:tONc6UrOW+RNVOK+GtU6
TLSH
T14802D8356D381C7B8EF26E0AB48B37175FA9207BA9856B84D6D81F0C01DB65C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4a8bbf1dcecf75247d8584f21ac868729d39d91175f2a9e33b3d27b692f8daa4
MD5 4896b12173ba357b96ccf689e6a024c7
SHA1 9c4fe38a30a2ad1d97e955b0da701234f697f27b
SHA512 81b6058c91a7e91ac001625195a03fd7c08804a109ca998a8c5fbb9f9dd79e88214861c7e7b83d7eed4b1725b387e90092ae61392b8019c06c110bb30785b152
SSDEEP 384:GtNn/s3n9SfsNInhu6bMEBVRNVOK+t9FRJmn15wbAjEJyyv:Gj+9UkOnHVOKs9PJmn12bfJXv
TLSH
T19D927C329C380C775EA29549F54B36179FB880B7A6C52E94D4EC4F0D06EF79C231AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d7f134c39ba4513c0c25837f911cb6c0d5e2375faf48d4fa562e25d93b031916
MD5 c6da9597eab5d4d8c0ea66b1fd02f546
SHA1 e3c7401a678faec1afdd0ec2359ded75371beb81
SHA512 0d74999e28685342d6a1e94ffbd57ed472583cf38f5a4be851a28c86a2a933c2aadaa5fb0f3ff59c9a06b518b2bc7e06a15cf3aa89be7bbeb4fe957bcfde9c4f
SSDEEP 192:LONh6JkRUQmiUykhz+RNVOmSY+y6l9nFIVcbqY5U6:LONh6UkPz+RNVOK+t9FfJU6
TLSH
T16812F936A9385C775EA26945F48735178EA55137EB896FC0D4DC1E0C02EF99C234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf1653a2-65fe-46fc-ac8a-b3599ee12399.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bf1653a2-65fe-46fc-ac8a-b3599ee12399.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f99e99778fe74d6bfaa7ff68a0ed4502256d058879dc0d29bf4259aa366de4b0
MD5 c8446975a2986a1a6d5c161b1345016b
SHA1 c2cfc313516660f2009a62050af49cc903510590
SHA512 8a405efa00f32f1cde54334c9cd79cef1b79f9c2e0af21ee66519ae149b733888d82ebb19ad02d8845706af0cfc0f8af4003f1c4d4fe32f406d8325047464e00
TLSH
T10C413F8CB6EA1119B3B76F5AABF7A86D487EB8732F06D45D00110E4F4623A40CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download