hxxp://' | Triage™

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/07/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://'
Sample260709-chpfaabx2m

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2024	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280363132395904"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1131776342-1023621610-2767477260-1000\{74F93CDB-D3F6-4E18-8733-60111FFF7AB0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5604	msedge.exe
5604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 2844	5000	msedge.exe	83
PID 5000 wrote to memory of 2024	5000	msedge.exe	84
PID 5000 wrote to memory of 2016	5000	msedge.exe	85
PID 5000 wrote to memory of 2668	5000	msedge.exe	86
PID 5000 wrote to memory of 2016	5000	msedge.exe	85
PID 5000 wrote to memory of 2016	5000	msedge.exe	85
PID 5000 wrote to memory of 2668	5000	msedge.exe	86
PID 5000 wrote to memory of 2400	5000	msedge.exe	88
PID 5000 wrote to memory of 5772	5000	msedge.exe	89
PID 5000 wrote to memory of 2400	5000	msedge.exe	88
PID 5000 wrote to memory of 2400	5000	msedge.exe	88
PID 5000 wrote to memory of 5772	5000	msedge.exe	89
PID 5000 wrote to memory of 5772	5000	msedge.exe	89
PID 5000 wrote to memory of 1236	5000	msedge.exe	90
PID 5000 wrote to memory of 1236	5000	msedge.exe	90
PID 5000 wrote to memory of 1236	5000	msedge.exe	90
PID 5000 wrote to memory of 5480	5000	msedge.exe	94
PID 5000 wrote to memory of 5480	5000	msedge.exe	94
PID 5000 wrote to memory of 5480	5000	msedge.exe	94
PID 5000 wrote to memory of 3104	5000	msedge.exe	96
PID 5000 wrote to memory of 5292	5000	msedge.exe	97
PID 5000 wrote to memory of 3664	5000	msedge.exe	98
PID 5000 wrote to memory of 5292	5000	msedge.exe	97
PID 5000 wrote to memory of 3664	5000	msedge.exe	98
PID 5000 wrote to memory of 2060	5000	msedge.exe	101
PID 5000 wrote to memory of 2060	5000	msedge.exe	101
PID 5000 wrote to memory of 2060	5000	msedge.exe	101
PID 5000 wrote to memory of 2796	5000	msedge.exe	102
PID 5000 wrote to memory of 2796	5000	msedge.exe	102
PID 5000 wrote to memory of 1144	5000	msedge.exe	103
PID 5000 wrote to memory of 1144	5000	msedge.exe	103
PID 5000 wrote to memory of 1144	5000	msedge.exe	103
PID 5000 wrote to memory of 2036	5000	msedge.exe	104
PID 5000 wrote to memory of 2036	5000	msedge.exe	104
PID 5000 wrote to memory of 2036	5000	msedge.exe	104
PID 5000 wrote to memory of 4992	5000	msedge.exe	111
PID 5000 wrote to memory of 2860	5000	msedge.exe	112
PID 5000 wrote to memory of 956	5000	msedge.exe	113
PID 5000 wrote to memory of 5680	5000	msedge.exe	116
PID 5000 wrote to memory of 5680	5000	msedge.exe	116
PID 5000 wrote to memory of 5604	5000	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://'
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff8169ec188,0x7ff8169ec194,0x7ff8169ec1a0
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,12861028460977013809,4248287335333509317,524288 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,2111464070337888698,9202154315585659184,262144 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:2
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,12977011628732965015,1674304828956086757,524288 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,13369418802142947793,6247398872888985091,2097152 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,14666962793188202836,16086767670678315816,2097152 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4896,i,15857606034219755624,4186260224183852839,2097152 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3564,i,8200550946315784011,10545138252394466449,2097152 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,16973624690465274843,2635335361652411671,524288 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,16973624690465274843,2635335361652411671,524288 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,16416450810789530183,540683356697950098,524288 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,16291166024564778018,13714525049225765228,524288 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6104,i,8770080192787567067,5014365072658010324,2097152 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,7444148533616213213,8118723103166690851,524288 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6396,i,9482414064926549445,12485310257858638648,2097152 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3660,i,17754861948367970211,10436198143429496091,2097152 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,5202602057807712583,9558419301371370175,524288 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,5143092440096737601,10926000640140803608,524288 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,4857577912410441214,2972447220752033237,524288 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,5503140401587594498,2063118219154084595,524288 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5916,i,2240443168263446477,11502627731661573572,262144 --field-trial-handle=2680,i,5773872375710074043,13037354774382977158,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8365d8597d396643eb3cb27ae8751c52f3b1ae3e25576cd2bd50becbaaae5ffd
MD5 b16e94a14013394e81faaffb1edb0866
SHA1 095be96d92aca0f788caa8c464e88fe0093428bb
SHA512 d08bfded37a6166d23fc97a47902156684e9e48ea9630c13d74b30f201e0b1cbdefd310a06a35543c33ad6c261585c043ccdbbaf6a515ba32c8540521104e42a
TLSH
T12CD022223B4AB000E2AB4132E2228740236908A128824604A218C86C4EA00C022C22C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e4479a36b7b992bbec7177088f2e15db8dffdd7e78e85279d2c83088a29343e2
MD5 03578bb8b6e22240ff9f962052e3bfd0
SHA1 e88cfa2a99ba4cde156cb76df3c1e5e4d0f31844
SHA512 14b486114c608d9c481d03eaacc4af4e96cd2250b09e5c1fbb1fe214e6bcbd9291efe72cc52c99c5a4d7d0533399a4d773de86fc6cc9233bb147b5ebe349bec8
TLSH
T177D0C0333F4AB000E2EB4132F363C740337D04A12C824604A25CC87C4EF00C022C22C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 173008e3333450fcc1b3e0a3f59d3fce0300e3cb2f7f8aca1ee91f0ad7171ff6
MD5 51dcd16317fb2f9e4e70a7fd5ef75349
SHA1 2d1db150cd91aa24fa4aa4c45d3f1687581f6569
SHA512 875289bdcecd408a9bd2bcc82e8f3b2aa80e3bfde64464aded2689e73d94400744a5216cde8787450690fc8a4d32e97ba7796171b8f5263cb276c3ac6a4b3b77
TLSH
T1E9E02366C832AC2719FE1B5810514745F65013171791454F7F3D43094FB413702C645C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 6fa4103f6064736d9338302e7d25e1daad504041808884e5af5a63330b47f111
MD5 2fae37e4aff1bc42b275ed23d386b703
SHA1 11e35045f89801f98246b78369237519712a7d19
SHA512 9e8c232b39d132e91891859db1b7e802891a1468ce67beafc314b228c005f6c41ae6f8973a93a6700e92b829f4ead7eb8319e8751938b4bc1122c39b60efed23
SSDEEP 96:TQes+w2npcwk+3Wqc7H+UMJUIN6xvhWLir8:TM+w2Aqcz+jJUT45
TLSH
T110C14BE6338184E3DF6EFA31B5E037347031A5766DC72FA5042E00F63A06380C865E9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58fa59.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fa59.TMP
Size 3KB
SHA256 1269d98cb70be3cbbddb067e93a296e7f1ed7082e8f4f87dc5651c420ef54037
MD5 6f2223427952784cf39687a9b311e888
SHA1 dbeb09034f26335784a61a54f5379a06d5eae592
SHA512 b136cdb838851677979d19b33b39174908d851051abc2978da2ecc77d37f5b60be3388af994536c7ac359bae70ddd8e147397fcf1880df43038f2157299284f7
TLSH
T1C9715CCB0542C8E2D36EFC76B6E533083062B276ADD32F36516E20F93A0A720C054F96
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1424a88c7d38cba230df349ba0371e1a3166db994cae144a451f7519c03194d5
MD5 b16a4264ea7134570c3962ee40b9de96
SHA1 3805e9f203a6c32c4d8bdfd89525a7f9f8053403
SHA512 dcedad9ec21de77be833489ca9b2aaacbfb9a5d7353f5c4f5e94799d23818747d8a854d24ed2db05a099eadc9ed166eb6cfef86bc6f680272b1a49e1603dbcfe
TLSH
T18B51DEF383E8825ED91152F0AA18BE1BDE1D0945832C3D5A85E4EF5BD3F2071E181E6E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 e4a85d6f950e7b77b8db1a931af508025cf3f391c19655640add6a000daecbde
MD5 ea700062d0aa7a111b8a3548e85cf35c
SHA1 3ef096875341cefdfcc481bb63e6cf3369acf3eb
SHA512 d4a1168ad3d51ad3323ca47e62d3c35b3e3f7136eb918940b250cda0d8b73a0a6d421487bdab0d5bc8a179d6d8e4e1acb0a6ed08cf58d0713be42cd342a8ea9d
TLSH
T1ACD02223120030F9BAAC7EA9506AEC8FDB3670600993DDE860D099AD25324BCAA07590
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 6d8b38f72e7d30112e7510edcf966dbf437924c499d5f322c5cec6547e8096c0
MD5 300d15a789f60d3a00b66d798d2e8274
SHA1 a354bb90292702042c58ada524b47f41380fa194
SHA512 bd1e506d52bd3f38d732afb3a61700d919a95c9a76417ebdf0defdc9e3778c333cd0859539b2979ef6145e567b3d48b46c0193c5bbb6c131b5d4efc00b5b68d6
SSDEEP 384:sxZO0qFm1N/f1s0/Et7+zyHbSB/VhXG5qx:s2jFm1N/fB/EHbM7gE
TLSH
T10282F6566A24C977CDD6D609B9657F93D7F900239A404E4CAAFCCA0C05EB6FC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ff9daad4932e7d7fad023010a47d5444c372992faf287a4a1876627e7313d7d2
MD5 fc6e2e62bc2e441abe586b5170dcf46f
SHA1 f056f1a5f47c04773eed9c9dae943e4f0acac6c9
SHA512 b0aca255c2dcd7aceccc92718124d868cbd95a4ba7d27f60ba2eda4eec0379c77305004a7c9fe17b8e18e8d5b3531b12877e50bab24f85ff06bb6435799bff8f
SSDEEP 192:sxZORbyMqZjK1Ml8MkN/f1smrqNCZtRzodprPHW6+WNGYquuPkXIgjhJ:sxZOEMN/f1smrmEtazHbGcjr
TLSH
T17A62D7166A345977CDDBD609F6457F93D6F91133A2904E44AAFC8B0C05E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 f0e62438c507a19f33c77fed4113c91dfb172d4fbc914eb841d90b3ee24b6e09
MD5 fae9bf3d839d9a188ddd428e050dd70d
SHA1 746a9e9d8837f71dec1b26c57a37ad26516d39d7
SHA512 daf84df079d4f3b78cf53ae0045ac3150cea082ad3c7730b17edbae67cf1f822bbd22dd7df7889a95218102cfec9c79bc9865738fde2f8d0f46353225cfb6a3e
SSDEEP 384:sxZO0sm1N/f1s0/Et7+zyHbSB/zhXG5qx:s2Nm1N/fB/EHbMpgE
TLSH
T12082F7166A24C977CDD6D609B9657F93D7F900239A414E4CAAFCCA0C05EB6FC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 651d18d7abaf1b4f4507289af79e93ffe95d6e230d9c89fe5a8aebdede26c27c
MD5 9dd7ae8c57ce3535e5c2baefe9ca8bf8
SHA1 42ae411589278d4b5e0d59c5b7cecdaffcbff912
SHA512 d3970861ce02bd450fc80ac93673893c9c190b78c5522e34d9398cded070a8ea2caf937ed0e05f9dcab65c8f17b0460350ce2b7ac68e6d0f0399bc5ac40ac43c
SSDEEP 768:+IM2tv5WvF32/8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4sLl2cNV9rolDWr5ljo:+IM2tv5WvF32/u1ja1sLUcV2lqrc
TLSH
T1EED2FA3B680CCB7E4F840E9CDC265F976ED4018BA698495487FA494C03C77EB522B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 7f60415fee6a909fea99968d26b96394e385aaf14ef99c440295cc6678a1fef0
MD5 431432071f1851442cdc2b6bce6ae864
SHA1 9254f64e3f9997968997b92729d863025602b2eb
SHA512 295252b2336cbd29eb9a2c5b9fc41bccde703c1dae74c1f32c0e20abb66c7dfb9927b97669f993904f0effa39aead11370ab327676543a45058b667424d99185
SSDEEP 384:K5jfYlgDWNF1/JTzpC27E4uoEvUxogWqFKFGep8hW:K5jfYlgDWNF1/JTzpHNW
TLSH
T118B27016313B12123CBD2808A7A6D6778E8231B3711DE66F7BAD04A54E67E125CFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6040fdd680436dc1b0ad2e0f6d6f00dc9e99a85df3e078450c012a6885515f4d
MD5 c04f21fd6d4f2e3d7e9da0637a0649e8
SHA1 ee3ec14eebae02aacc315eec1876301f83708742
SHA512 0af2245b9528c468cba20190a394440aac5b4475060c64ac74efde1d382bda134d6905f9ce268c7db4ae5e2fb0992643f7a429e8d97db9fdc6978940a02999b5
SSDEEP 384:npiF1tNn/s3n9S5sNe8TUNTUlI4kxn7fWau0wiBfCUGiJwOMuhMOObjI9G6w7Rbn:AF1j+9WVwgtzHGiJWuhM29MR7
TLSH
T1DBD24A32EC55CAB7EDD74BD6B74A3A46EEE04263868C5AC8D6D85E4C01C71DD430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6351ab378e08dbff50d86cb3dd0a1841449c326a81f461dc201490cdd49c8648
MD5 7827aa1a08f8c3adee02072e5481f989
SHA1 b54585718ad445926d59106db5d3d1f917b36a23
SHA512 7de2ac36ee0e3e7dfdcf5470580939bb6a920c900abe8e088677ad5126200795dad485795d34baf92d0f9c3e730a5c6e4f253bdf5f15afdbae0b1067d65da594
SSDEEP 384:n9iF1tNn/s3n9S33sNe8TUNTUlI4kOn7fW0LwiBfCUGiJwOMuhMOObjI9G6w7Rbn:0F1j+9a3VwgeHGiJWuhM29MR7
TLSH
T185D24A32EC55CAB7EDE74BD6B78A3A47EEE0426386885AC8D6C85E4C01C71DD430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d2c862d960e2db465487b40bbee1dceac46033fd5d10fe57f4d1d30a829da332
MD5 f27e414eb113cebb9c238e3cad63d5a8
SHA1 899f368746bde94719bc1c0633e6503ec4f4f4c6
SHA512 20c5b078ccb106fa8bbce57b485c2b7b75b402114d61abb01cc7fa78c8aa8ae26cf40c7afc29eaa5518cf82ff3c0a3cdd9358fbbe342596a0bfae3638b216abd
SSDEEP 384:n9iF9CcmyWCv3sNe8TUNTUlI4krGn7fW+KwiBfCUGiJwOMuhMOObjI9G6w7Rbty3:0Fccpv3VwgvlHGiJWuhM29MRk
TLSH
T10DD25A32EC54CAB7EDD75B96B79A3A43DEE04163C68C9AD4DAC95E0C01DB0DD430B806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 86724e37af6cf0fa0aa483d9a3b536a905a33130939c18affb7af6645f697e3a
MD5 b6805eb2c8c95f7bcd3d3d2c28118766
SHA1 2b449879055d28a5b304e31a81cd5a3faab3b4d8
SHA512 fc3680f3471f267c626594fcd8639c2dcac3bd6456cd71d30c2c3effa6eba2af9af2a8a9f05d3e2b6c44c84e7cf13160dacf331762fbbd765f6cd7340a59ef68
SSDEEP 384:nNiF9CcmyWCs3sNa8TUNTUlImkrn7fWm8miBfCUGiJwOUVe4KV8p0OH8ty/7Igi:EFccps3VwgWRGiJqVI8p046
TLSH
T184B25B36EC65CABBECE78F99B74A7A03DED05127C5D88AD8CAD85D1D00871DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 54fee78b0302dc5370f05dc22679cc9366e3e55bae05991e1d7231f94648de1e
MD5 db834a655f3691157f14bd06978751f2
SHA1 142e77468bb0770d39990178b9bcc082e511fab7
SHA512 d4fc85ec644f2f610ac757fbfea2b0bc4dd3cd93c2eb273166b18aab7b6764c6da8bc930f9e49ad54766730c73eeb74db89c7f3b615a012bb1ea4868a4ca02de
SSDEEP 384:nziF1tNn/s3n9SCNsNe8TUNTUlI4kxn7fWauOwiBfCUGiJwOMugMOObjI9G6w7R7:eF1j+9HVwgtxHGiJWugM29MR7
TLSH
T1F4E2D5F298D38977E89E4B97A77E2E469AFCC153B5885984B7C85D0CCC861BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9de15ba9eceb510e512a00e2537e3f62765de7f31f15e515cd8b71352bf5e826
MD5 fb9d05bf41fedfb80af31b145651b62c
SHA1 bf8ccb8069a99286e1956ab626cdf3e238c04907
SHA512 14183651b85fa605d1df51173ab81dcd061e5667380c16657a1fa3bc0ef263134f19b62a0052ab10d1eb8cba84fd757928bd57946ff9ff8587b585395deff473
SSDEEP 384:nZiF9CcmyWCs3sNC8TUNTUlImkrn7fWw4diBfCUGiJwOMumMe4KV8p0OH8ty/7I1:wFccps3lwgQgGiJWumMI8p046
TLSH
T18FC24B32EC54CABBECD75B99B78A3A02DDD09223C68C9AD4DADC5D5D00DB1DD430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a2aa7ebff7cf882488416b00dd1f48a41943983961b90e002c528c353cce33bd
MD5 49e31a9953b08dfbfb1b23cf2c2fefd5
SHA1 e5bf13809654ccd31c2c247a682a24c9419e9e6c
SHA512 a5b588fda9c898ba3e448fcebcdc0e0fce79ab495dc4f3cec2d847bdff893db474abcb9314b0ebc828284f14ddf0bd3a22c8b55444e8729aefb554bea6979b82
TLSH
T112412858BAFA114873736E5A9BF2686D487FB9772F06D48E00110E4E4A63B41C871B73
MD5 SHA1 SHA512 TLSH

Submit Download