hxxp://gfs302n152[.]userstorage[.]mega[.]co[.]nz

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gfs302n152.userstorage.mega.co.nz
Sample260709-ydc3cagy6m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4304	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280996293381934"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{40E0DFB1-CBD8-41B1-97A8-948DE8E30407}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1140	2876	msedge.exe	87
PID 2876 wrote to memory of 4304	2876	msedge.exe	88
PID 2876 wrote to memory of 4552	2876	msedge.exe	89
PID 2876 wrote to memory of 3928	2876	msedge.exe	90
PID 2876 wrote to memory of 4552	2876	msedge.exe	89
PID 2876 wrote to memory of 4552	2876	msedge.exe	89
PID 2876 wrote to memory of 3928	2876	msedge.exe	90
PID 2876 wrote to memory of 5020	2876	msedge.exe	91
PID 2876 wrote to memory of 3808	2876	msedge.exe	92
PID 2876 wrote to memory of 5020	2876	msedge.exe	91
PID 2876 wrote to memory of 5020	2876	msedge.exe	91
PID 2876 wrote to memory of 3808	2876	msedge.exe	92
PID 2876 wrote to memory of 3808	2876	msedge.exe	92
PID 2876 wrote to memory of 2592	2876	msedge.exe	93
PID 2876 wrote to memory of 2592	2876	msedge.exe	93
PID 2876 wrote to memory of 2592	2876	msedge.exe	93
PID 2876 wrote to memory of 4956	2876	msedge.exe	94
PID 2876 wrote to memory of 4956	2876	msedge.exe	94
PID 2876 wrote to memory of 4956	2876	msedge.exe	94
PID 2876 wrote to memory of 4908	2876	msedge.exe	97
PID 2876 wrote to memory of 4908	2876	msedge.exe	97
PID 2876 wrote to memory of 4908	2876	msedge.exe	97
PID 2876 wrote to memory of 664	2876	msedge.exe	98
PID 2876 wrote to memory of 664	2876	msedge.exe	98
PID 2876 wrote to memory of 664	2876	msedge.exe	98
PID 2876 wrote to memory of 4868	2876	msedge.exe	101
PID 2876 wrote to memory of 4868	2876	msedge.exe	101
PID 2876 wrote to memory of 1984	2876	msedge.exe	102
PID 2876 wrote to memory of 1984	2876	msedge.exe	102
PID 2876 wrote to memory of 2460	2876	msedge.exe	104
PID 2876 wrote to memory of 3012	2876	msedge.exe	105
PID 2876 wrote to memory of 3012	2876	msedge.exe	105
PID 2876 wrote to memory of 3012	2876	msedge.exe	105
PID 2876 wrote to memory of 332	2876	msedge.exe	109
PID 2876 wrote to memory of 1524	2876	msedge.exe	110
PID 2876 wrote to memory of 1020	2876	msedge.exe	111
PID 2876 wrote to memory of 3028	2876	msedge.exe	112
PID 2876 wrote to memory of 3028	2876	msedge.exe	112
PID 2876 wrote to memory of 3028	2876	msedge.exe	112
PID 2876 wrote to memory of 1224	2876	msedge.exe	121
PID 2876 wrote to memory of 1224	2876	msedge.exe	121
PID 2876 wrote to memory of 4656	2876	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gfs302n152.userstorage.mega.co.nz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffcb753c188,0x7ffcb753c194,0x7ffcb753c1a0
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,6793859863921352549,14274542256861131942,524288 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15024297619831935221,9341430509292551136,262144 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,2510317389166653126,16506747844229692928,524288 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,5872093480261562522,344669370747867595,2097152 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,4486342769548461364,9971503484750618189,2097152 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,3483388505678646096,7203850019185066694,2097152 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,5822270758045541463,11689133486885571399,2097152 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5000,i,15366338881917566103,17205916450967039515,2097152 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4716,i,2747317357893501902,13334889629585952238,2097152 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,13277582163843079168,8153850075389234308,524288 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,14570190385066204228,6769266782106067772,524288 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,5459395157963924224,4090963996518639406,524288 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,5459395157963924224,4090963996518639406,524288 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6204,i,8820504560647815468,3053459555010436534,2097152 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,13282295021891721875,188915783640547258,524288 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,6024397351339416095,16461720772734185228,524288 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,11167586572406492964,3774423571018524374,524288 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6660,i,11251084240818636842,8284081485115056600,2097152 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,5178474063693574665,14332411525860015976,524288 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5768,i,10901843540703115460,6062227299465402431,262144 --field-trial-handle=2324,i,4222127392404984630,17186920952572006961,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4e77fa9d6a9bbdca873a932d2a8527f982c645f06fdfd0b4cd22ebd77fa0dce8
MD5 faf339b08cb491ab6583f6f6e73f5655
SHA1 a10a8cdbaddaff4a1893c1df1e4b9c44b2abd159
SHA512 b6ad1a756f569a1bb8479070004185512082edb1bcee94616e8b58e4242137cb255b36642c07e6726f7e78634b9c5a07f222b1e5978e244950b2aa7fcda97e30
TLSH
T16C61E7BD0582EDF6E3D13A3190C03A9738F191E8FD63FD5D01E348B5641AB114A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588c4d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588c4d.TMP
Size 3KB
SHA256 5d831aacf5874f316a5470cfcf1096c534362476a50b9cccc7b8c722d84c6210
MD5 288ffe4ce0edbbbb1fb73dc65b8d85e3
SHA1 4fbab5c6c64910f5f406b5d472dcec328762737d
SHA512 34b980f0e5c4f2061367d54858113ef2517447586a25d085e78fd39f254e2e0e2e867992ba95c4b2f26975075abeb04df12face02352421a49d7064f32db1af6
TLSH
T18F61C3BE0582EDF6E3D13A3190C13A9738F191E8F863BD5D01E348B5640AB614A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 71a0a387297d3c7ac09ecf49d1f3a3f8c8c2010c0c40f7878ec1dde95e18832f
MD5 b1450bba9cbf992984464add10cd5eb9
SHA1 ecfa38e338d0edd347706d2567b3fa205c35fcca
SHA512 3b22223cdf0685686d2baaec391be2765264ce758a15b53ac67f59862066bfc298afdb214873693150fb18607bfebb8b1036f02d26043505fca51b9e5fb3c6ea
TLSH
T1CC21DDF3C3D5856EC91116F0AA28BE1BCE1D0502431C3D2A89E4EF5BD3E3475E102A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8f11108289fa06af9e5177729ed0833c32bd6f95e7014def84eec01a899cda22
MD5 cad1f5250212dff05cdf2207b4ab728a
SHA1 318ae978bb8c74c0eb95b1a7089382c5a36d4952
SHA512 c50619cbcb050deec254dbe7ae59ab56e05c95e947761d61eeb9d0cb67bd8efde01dfd4e720f901c01f896adedd1a21905971f9d24e203f3d8709394b241e376
SSDEEP 192:sxZQRhyM/jK1Ml8UQXkw/fasUkHlrSIdp66IHK76+WN6o3V/Y9ILyDbIg58J:sxZQfqUw/fasDFvcHdb/O6
TLSH
T1F352EA12AA345977DCDBD21DF9417F93E6F5447693901E44AAFCCA0C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 701f6dd884de9b816a93cccdc2340c4786d31f324b0903d17ba32a0eb4f81964
MD5 9e2d0c174a689ca64270e12f5a33f51d
SHA1 a35132061d45df83cb630440229714457f29a8a1
SHA512 c73f477664153240bab7d721cba2250a082666b87f5ec6c512a67934b05873fbdb967c07fd17d02242624b1bc319be2ab692ff40a0bb14913d98dd4dc5e21afb
SSDEEP 768:X4cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNBrovg6h:X4cv21wWvu+Z+u1jaeFLeRN6vR
TLSH
T14FD20A2B280CCB7E4F841E9CED2AAF866DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 43390f437983f7f5592783b5c9c3f69ab51ab58a0842ab7e60abb3c1f1c26de8
MD5 054b8da96e45e2f2703ac7d85b0ce6ad
SHA1 073937bf6bdc8a69da8926b63bd2dd5fc446412f
SHA512 e4b684d90fb8aa7936343993d970eb478d00096542a0b6e298e43e0325b20b83416ad3acee958e6e3755717bc4f199325e6007e83df16059daa9a4cbb095731c
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTyaHfItpfd9xWJmsgRxK44g/xcnvOM:mTfHHfItpfd9cJmtR74g/envOR9SHlye
TLSH
T176914002313A02C2397E784CA3B9856A5E8271667415E97F7BBA00A14B67E129CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc7dabaf-fac9-432b-8e06-8201efca113a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc7dabaf-fac9-432b-8e06-8201efca113a.tmp
Size 12KB
SHA256 e3fca2d1b990e25db6b1549258d50360bb486285890f9306404cc910a881781f
MD5 d601b375d49e66ad6d2c728c61b3aa1c
SHA1 5a860717d51f2c3a804dad5c83d4c6769e670c05
SHA512 f62e0ed82b9b23b70841c982f3e2e677ff265a449e3c314442c0a696b9874b747a0e2580e2d56cc13b8ede05162f0a246e166b2c466528ef68c76fe81b5a0fa8
SSDEEP 192:sxZQRhyM/jK1Ml8Mkw/fasUkH1rSIdpnIHW6+WN6o3V/Y9IHlDbIg5WJ:sxZQfMw/fasDVvIHbb/Jg
TLSH
T14952E812AA349977CCDBD309FA457F93D6F5057293941E44AAFCCA0C04E6AEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd24612e-d0fb-4276-a538-9adda3e3185b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\dd24612e-d0fb-4276-a538-9adda3e3185b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5848d64ccda20ba74439b94422dd28e26c4dd6b949f6e78d9ebb0ef9030f2ca4
MD5 07b4933024eceda38aa7b08575310e4d
SHA1 4d3fd011ad609f9897851b5fef6e076fcb864e4a
SHA512 2124f98b71342c5b476841b8ca2a6e6cb04dded6b93af118a2c5f1af2d0f09fb97ba7989bbce09f4f4035156082bf572f601f2e38c57a7dd9b08d1da12570d09
SSDEEP 384:ltNn/s3n9SfsNnnhwNWzivDje+CXOmep3Jr2lHOObjI9G6w729q:lj+9UGNaCvO9p3h2lH29Mv
TLSH
T1A6928D32A8290D775EE256A4F48B39179FF851BB97893F80D1EC7F0C06DB6AC430651A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 e64517b90b69948059c82ac3da8d3277898b78a82a28c1e8d40178f5af0520a9
MD5 9e91054769ef5eb85931301b3bf4d373
SHA1 bba840f7cd8847a61c0f44b5a2463637e7497d8b
SHA512 7da75f20ad0b91243866ed891e8eb8970d1e7fd565b537b644de2068543a2aea0a8f5a13375dd71bbd55027188a7eddb36275ef858f24eec6a194882fcb3dc8e
SSDEEP 384:YiF1tNn/s3n9SYzsN58TUNTUlIlChwNWzivXje+CXOmep3JrLlHOObjI9G6w729q:jF1j+93Ywg+N+CvO9p3hLlH29Mv
TLSH
T1F0A26C33A8588D7BAEE24B95F94B3617DFF451BBC6853A80E3D86E0C01DB6DC0306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2469e2b01126f2511e7c0c5572c4fa995f1805d881de8bc97cf03e07d87fe6aa
MD5 c2beaef39d1c05ae1719fef3ffe82724
SHA1 8eb3c52cfd9248623e1c99ab0e13a6d19eab900e
SHA512 fb2cb0d0904ad39e99fc87af06bc822503d87c3210c424fe0d2d67340bb728280fb7498a45e60b010adcf96ac1f9defa218ffbfdc95a2a788f237cf9a4c31608
SSDEEP 192:JONO6v+YLNQmiUy4NZh+CG6Om9oEusulU6:JONO6vz/DZh+CXOme6GU6
TLSH
T18A02D935BD281C6B9FF26E45F9873B275FA8217BE9952F80D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 10139038658df633fc328c76789cb62f6f436e8e0c6f898400e4a15cf46438b1
MD5 d205357b71a4c2ae59f436a52d28c34a
SHA1 81ca06701d061987f65f19a63da5d3d3c2509011
SHA512 6fa32dc13bfaa12924de75b13f9dd4b600f9d7b3a156f51d1726f81030b04f51acad8213fe8cf794c7652162d11218e84fde10e87a75496edcb3079af561e917
SSDEEP 384:HtNn/s3n9SfsNnChwNWzivXje+CXOmep3Jr2lHOObjI9G6w729q:Hj+9UFN+CvO9p3h2lH29Mv
TLSH
T188929D32A8290D675EE256A4F44B39179FF8517B97893F80D2EC7F0C06DB6AC430651A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f76453f072ad416688c77da5dab3ce038320fa27f94a4fe3a4977711f94359b9
MD5 f0a7a42698aacfdb7af6dea1d8fb3a70
SHA1 21407290dc4efaf0fde58b1190cb24f9b3a9e6a5
SHA512 c57d3b19b278e84a0dc065ead4e7de9104bf011a6dfe63068ba2fef83781f868cf9432f849af61ca0431ad53c1bce377f38b1935cf43cb6f81ce99df005ed6cd
SSDEEP 192:TONy6v+YLyQmiUyuNxh+CG6Om9opwSJrHCCHlbqe7U6:TONy6vzSfxh+CXOmep3JrLlHU6
TLSH
T12B122B36B8285C6B5EE36695F48736539EA85167DB8A3F80D5DC3F0C01DF69C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3eff8ef5f775095238ed59ed831fbb955426c65135b35ba6dcae0c78bb1b7df1
MD5 1b46fac98e1207fde8b7674ef97f577d
SHA1 44637e9412e8113df8aa972e2192ab90df4e6c90
SHA512 9f552bcb3dcdc6a3604ac84f29b326a893af1b442afba0e79bd470804605fa33ff6074121f05ab486360c22b08cf48ea5279f44fc82b36d1abe793bb7de0068a
TLSH
T1F541255CA6E90148B3B72E56AFF6A86E587FB8773F0AD55E10110D4F0A26B44C871B33
MD5 SHA1 SHA512 TLSH

Submit Download