bdc5bd4bdf316706a6e2e589ab22dcc54176aba5dc5d49d04c7323d4708b73ad

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.html
Size 4KB
Sample260710-ajvycact9z
SHA256 bdc5bd4bdf316706a6e2e589ab22dcc54176aba5dc5d49d04c7323d4708b73ad
MD5 409f4aabeb0d5972c1ce5c443e3b4944
SHA1 d362d7fa70b830f6e2a8c31aff2dbaa3635c5ac2
SHA512 b73d79417ff85098b2dd85e47a4c17a885b4aac8a7534f3124a4abacc66292c9210c17ea64626fe0d51d39be0fdc57c1b10946644d6d6a95e49adec0d233a904
SSDEEP 96:fjFj7jOjEUDK/D5DMFLzLeiO/tjGY3ueZNeBuC7RslvaQxvbzM:fjFj7jOjEIK/VoPnOVfeeZyuC7qlCejI
TLSH
T1F3B19573F9BD107F20D3827261BDB70A3AA5C143CB9608903ABCC2755F8AF55AA132C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1820	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{1F6B7431-F9EB-42F9-A0F1-A76D9C88046B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 5660	5800	msedge.exe	86
PID 5800 wrote to memory of 1820	5800	msedge.exe	88
PID 5800 wrote to memory of 4056	5800	msedge.exe	89
PID 5800 wrote to memory of 2904	5800	msedge.exe	90
PID 5800 wrote to memory of 4056	5800	msedge.exe	89
PID 5800 wrote to memory of 4056	5800	msedge.exe	89
PID 5800 wrote to memory of 2904	5800	msedge.exe	90
PID 5800 wrote to memory of 4728	5800	msedge.exe	91
PID 5800 wrote to memory of 5624	5800	msedge.exe	92
PID 5800 wrote to memory of 4728	5800	msedge.exe	91
PID 5800 wrote to memory of 4728	5800	msedge.exe	91
PID 5800 wrote to memory of 5624	5800	msedge.exe	92
PID 5800 wrote to memory of 5624	5800	msedge.exe	92
PID 5800 wrote to memory of 1664	5800	msedge.exe	93
PID 5800 wrote to memory of 1664	5800	msedge.exe	93
PID 5800 wrote to memory of 1664	5800	msedge.exe	93
PID 5800 wrote to memory of 5944	5800	msedge.exe	94
PID 5800 wrote to memory of 5944	5800	msedge.exe	94
PID 5800 wrote to memory of 5944	5800	msedge.exe	94
PID 5800 wrote to memory of 1736	5800	msedge.exe	96
PID 5800 wrote to memory of 1736	5800	msedge.exe	96
PID 5800 wrote to memory of 1736	5800	msedge.exe	96
PID 5800 wrote to memory of 2308	5800	msedge.exe	97
PID 5800 wrote to memory of 2308	5800	msedge.exe	97
PID 5800 wrote to memory of 2308	5800	msedge.exe	97
PID 5800 wrote to memory of 244	5800	msedge.exe	98
PID 5800 wrote to memory of 2620	5800	msedge.exe	99
PID 5800 wrote to memory of 244	5800	msedge.exe	98
PID 5800 wrote to memory of 2620	5800	msedge.exe	99
PID 5800 wrote to memory of 4980	5800	msedge.exe	101
PID 5800 wrote to memory of 3768	5800	msedge.exe	104
PID 5800 wrote to memory of 4568	5800	msedge.exe	105
PID 5800 wrote to memory of 1380	5800	msedge.exe	106
PID 5800 wrote to memory of 2792	5800	msedge.exe	107
PID 5800 wrote to memory of 2792	5800	msedge.exe	107
PID 5800 wrote to memory of 2292	5800	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc14c5c188,0x7ffc14c5c194,0x7ffc14c5c1a0
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,17405311385758625460,1175788314468867130,524288 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,4440923912168774445,15736644735468969903,262144 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,17385388981235094419,9441603125590219646,524288 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:13
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,14578447444236995102,14416592146789112077,2097152 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,8660786009040049664,9953982246827132099,2097152 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,13101145242771596376,10435632618701733464,2097152 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,13157080580125729096,9555262406379258157,2097152 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5276,i,1430456534594323352,9858115481070343544,2097152 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4796,i,11156521977986426,2233497152051390752,2097152 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,14780047653178952000,7538486266421882500,524288 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,9358559089079431053,17669156895540172597,524288 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,14166059740117510780,7721523923812608584,524288 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,14166059740117510780,7721523923812608584,524288 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,10890342648534616514,6493529317739619318,524288 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,3727407391090635543,2835356475829786736,524288 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,17815547050424858195,3063284153701259021,524288 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:14
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,12104179111149853283,6594566126215636167,524288 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5816,i,1087674488158316556,6064212774868185595,262144 --field-trial-handle=2476,i,17211076045681501203,2108389494333626102,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 17a77fad9d64c1e84619e5a956c8eecc762df3042a507f63af95e249e1135d4f
MD5 dff9bbc418467dfeca9c4c1e7cc4e891
SHA1 9cab2d04a6289377fc5983dd65886b39b9696179
SHA512 5f76df1c86f1ed154c28afb449a418447b0e8255ef1fb6e819506276a168f173e7b3bb584eed18eaca64803b3c94ca0f7aa576d85edc6ea3abff7564ff7aeea2
TLSH
T18E61601423E73AD1F32B56F1B2E2A66876F4445D06072E139381BDF29406F38E8EA453
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d140.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d140.TMP
Size 3KB
SHA256 2e76ebfec348b55e3416ca5ef11f15e5ed61d217a8f2106a0970431fcb1fa605
MD5 25830e16001233ed23ce5864a270c280
SHA1 dc8fef68ecb46d531b1c1018c1ba5fb2281fe5b8
SHA512 45e4410762bb149b9767e807f28e8a67f0a3e1dcc0ff56608be1ee4a82dd8ca96d11807a356f37170ad2bce2478d6156c88a7ddcc0b7b0fdbbc03b4911f8cf24
TLSH
T10361721423E73AD1F32B56F1B2E2A75876F4445D05072E139381BDF29406F38E9EA053
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 007c4d70a9da5874b76690fa08608433f553d53f2b384853e6b7e2c3148a0c2e
MD5 c64925b27bf3cdf1ebd3a97b5d351b70
SHA1 841090d3c7b74137f74118b3b5c4f8dad716cca5
SHA512 ff495dcab43f76539a6c548b188b496c6769fe4e709a3747f704bd7c89e65f6a87df7309f8bcb7a3968a05ecb28b33f6d64cca5098374687899c21d53bdf61fa
TLSH
T19D51BEF7C3E4866D981256F0AB287F2FCD1D0A55422C3C6689E4EF0BA3E2471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5806b951d4fc1edc1c4bdfe355d9c7f2f834b6147ec57ca3029f66e37b8f60ae
MD5 6a8b55177f56108ade810f2419b19110
SHA1 f78e39240ffea686854b15e016158550194f93f8
SHA512 b04be5b5867da7a74d3a96d4526c733566a4de1968cc96129804f187e05b30e456b5c72e3a9310b2f4cb7b427c32377e8308b1c220df5adccee358a15410f89b
SSDEEP 192:sxRhRvyM/jK1Ml8wbdv/fQsQZYprQ53szoA8p4py/g6+WNIYn83hjGrIgD6J:sxRhXlh/fQsoYWMy/5ITRKq
TLSH
T13152D816AA345D7BDCCBD209FA557F93D6F85473A2901E44AAFC8A0C00E66ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b8ed262cf04005e9faa8997f23dfc865afadec3f0e35de78429e80dd9b6106d8
MD5 b69f015d76bd7c5ef866c0c102f7d0ec
SHA1 bd222d84e3bdbfd2ef3d7afcbb4839a1ebd41481
SHA512 b940f0762f9841a1987de5e3e5e8a1d38d325b4fc76a7b027f953e9ed08ba91c6c2f26c5e74117e50e58a98386b314facfa87f526f9db8f2db4f2c39a686ae98
SSDEEP 192:sxR6RvyM/jK1Ml8wbdv/fQsIZYprQ53szoA8p4py/g6+WNIYn83hjGrIgIJ:sxR6Xlh/fQsAYWMy/5ITRKs
TLSH
T15B52D8166A345D7BDCCBD209FA557F93D6F85573A2901E44AAFCCA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7db6a6b3361cf269888f76ac66eed06136811742bc3eb0e6fab2b1c37c94b51b
MD5 fd75b17c6f8b4b8e74c3154c7318f8d4
SHA1 ef81fb6fc57aabd1b30bfe5defbc5dd9165180c8
SHA512 36a37afafde154b9fecee60bea465631cf0a58b1185cd7a06cfe8cf53a1c1d61060dfae32f9243cf3be80bf7630b785fb67038aecb9823becd3596a1264d5931
SSDEEP 192:sxRhRvyM/jK1Ml8UQNbdv/fQsQZYprQ53szoA8pepy/g6+WNIYn8ThjGrIgD6J:sxRhXq1h/fQsoYWGy/5ITlKq
TLSH
T17F62D816AA345D7BDCDBD209FA557F93D6F85473A2901E44AAFCCA0C00E66ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a9dc496e95fc5ee61988e0b971b882411328023168588d5e7bfe59cb8eca727c
MD5 ca8e083604e8548c55ab7ab2657b5e0e
SHA1 890425f0cf641056331640f634498b366df1d3d9
SHA512 1d1c3e94e11c54d2b241089d7288f8e5ecc9753a16df28ffa8d70ba3b0bff15f596cda8355b5a907ed021c506bf730b8be89e26eb57d3cc4c168d052056dbde4
SSDEEP 768:wGedp6WgoufxM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIu4YXroSg8A56:wGedp6WgoufxMu1jatVYEXU
TLSH
T17EC20C3B640CC77E4F844EADEC29AEDB6DD801CB5B984D5447EA890C03C67EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1d1c790c5e38cbec84f9569e962eb8b2bc116ed049d81b2290b7d52bcb5550ac
MD5 4c01d876a5905506dfd53caddd50791a
SHA1 7826ae631e36a1c3d12b4bc6b00173849bf0ea85
SHA512 fc2cc1bec847c20e02c1915c3fc59e1bed985ea34ce4ca632d9f410481e105890eafedde68a9b88f7c8398dbca9834ab54e912abf7cb73f7786657bb89751189
SSDEEP 96:KRfItpfd9xWJmsgRxK44g/xcnvOR9SH5WnjRzHDW3EygrDK4aglDcJh8feNKKWwS:CfItpfd9cJmtR74g/envOR9SH5WnjRzx
TLSH
T15F91BF11313E0291387D7A0980659D6EE2C274B37169A42F3BE911B64F6BE02DDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

796cdf74-839d-4cc7-ae69-d666c8ee6c4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\796cdf74-839d-4cc7-ae69-d666c8ee6c4a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6c87ddaac75063b904076cbeef216e3a1594d73c267ef5b7a720ae166db34745
MD5 f8f072dd78bc783ef5aa1b9010bdc07c
SHA1 68708f8ef0b67b21153d77c00e0aaaedd155f89e
SHA512 2f0dfdcfbf20f0eeba1c079a3159770d52fe52a1788dc1d8201393d33f0c9f05b376a0df7732cbb894df5d9ffe26ae1f35a2c9a72a5e30288c1cd4b30af62656
SSDEEP 768:Rrv+4UNbd43fTHDZIO0ynfS3Nzc4ReyIsPvb4Uy:Rbsbi3PfS3tc44bsnbpy
TLSH
T10F03BF36F8388973ACF69685F40B7643BEF4511B86C91A94DADE1F4C0A8B5ED130B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e6bc0fcc3dc8f03693a61a4c2c7aaf65e3919f3d74da27acdb0fb66af98b6598
MD5 ebe654c268fd904bd7f6136df195765a
SHA1 5fe0e1ff6e933ebfe30921c8475d2a3b943ab42c
SHA512 8216a8c32bb183a76009a9cfffadd671a00c62400f5d3f64835d55f32b57431731c9b0b72bace94e37ef5e376d11317351a3eaa0d5ea0d3a08770fd00836d541
SSDEEP 768:Kj+9W3tGHDZIO0ynfSmNzc4ReyIsPvG44Z71Pb:p9W3ofSmtc44bsnG44B1z
TLSH
T1A9F2BF32FC229D67ACF58695B5173A43BEF4522782C42EA4D6DC6F4C06872ED134B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 a60212bc590f0480954be6530592ae9bcf22812cdeef9f2677083bfa3c3cf013
MD5 f1615eefb6864547b99d4b970f825eea
SHA1 cd90801e1cee04ab5c3e2ff489d0c30f3f11d0e8
SHA512 4aff2d0b951e2e222a1b49ca5829f3dc6e8de58c655059dbd700f9139e471a427ace3c0b7ce70c22d8ef25da901b50f407e7f7f38db13092dddf658ffdcbeed6
SSDEEP 768:HF1j+9W3twg8GHDZIO0ynfSWNzc4ReyIsPvG44Z71Pb:u9W3NfSWtc44bsnG44B1z
TLSH
T1F203AE33EC65896BBCFA8B85F61B3642BEF45267C5C56DA4D6CC5E4C02872DC034B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 534f6db2a42fed7091b701a99053abbcbe9905b4710dedb969df8a2abd50b2c5
MD5 bf4e6358777ce47bfda039cc72a21e00
SHA1 f14787b46e8380feb4615dd4c570f7efef600c02
SHA512 59356f8c89ea050997095f49639a6e8a8166de40958a7fe48ba15350fefb41b75f4aab8c1ca7fea06381f594e2f6f21a526793f475e628474e110bbbdf6e927e
SSDEEP 768:6rv+4UNbds3DdDZIO0ynfMNzc4ReyIsXYeVH1S5D:6bsbS3NfMtc44bsIEH1Y
TLSH
T1B103CF36A8788937ACF6A686B04B76537EF8511BC2D81F94C5DE1F0C4A8B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3de7b83-94c2-464b-81fd-b82132381a56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c3de7b83-94c2-464b-81fd-b82132381a56.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download