hxxp://ww38[.]store[.]segurosmonterrey[.]com/

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
13/07/2026, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ww38.store.segurosmonterrey.com/
Sample260713-tzwpcsd121

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1784	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284338258348049"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{E531BC60-78AE-4105-B974-BD6630AE8C1F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 4420	3732	msedge.exe	84
PID 3732 wrote to memory of 4480	3732	msedge.exe	85
PID 3732 wrote to memory of 1784	3732	msedge.exe	86
PID 3732 wrote to memory of 4480	3732	msedge.exe	85
PID 3732 wrote to memory of 4480	3732	msedge.exe	85
PID 3732 wrote to memory of 4060	3732	msedge.exe	87
PID 3732 wrote to memory of 4060	3732	msedge.exe	87
PID 3732 wrote to memory of 3844	3732	msedge.exe	88
PID 3732 wrote to memory of 3844	3732	msedge.exe	88
PID 3732 wrote to memory of 3120	3732	msedge.exe	89
PID 3732 wrote to memory of 3844	3732	msedge.exe	88
PID 3732 wrote to memory of 3120	3732	msedge.exe	89
PID 3732 wrote to memory of 3120	3732	msedge.exe	89
PID 3732 wrote to memory of 2408	3732	msedge.exe	90
PID 3732 wrote to memory of 2408	3732	msedge.exe	90
PID 3732 wrote to memory of 2408	3732	msedge.exe	90
PID 3732 wrote to memory of 1780	3732	msedge.exe	91
PID 3732 wrote to memory of 1780	3732	msedge.exe	91
PID 3732 wrote to memory of 1780	3732	msedge.exe	91
PID 3732 wrote to memory of 4488	3732	msedge.exe	96
PID 3732 wrote to memory of 2464	3732	msedge.exe	97
PID 3732 wrote to memory of 4488	3732	msedge.exe	96
PID 3732 wrote to memory of 2464	3732	msedge.exe	97
PID 3732 wrote to memory of 1192	3732	msedge.exe	99
PID 3732 wrote to memory of 3400	3732	msedge.exe	102
PID 3732 wrote to memory of 3400	3732	msedge.exe	102
PID 3732 wrote to memory of 3400	3732	msedge.exe	102
PID 3732 wrote to memory of 3852	3732	msedge.exe	103
PID 3732 wrote to memory of 3852	3732	msedge.exe	103
PID 3732 wrote to memory of 3852	3732	msedge.exe	103
PID 3732 wrote to memory of 384	3732	msedge.exe	104
PID 3732 wrote to memory of 384	3732	msedge.exe	104
PID 3732 wrote to memory of 384	3732	msedge.exe	104
PID 3732 wrote to memory of 3376	3732	msedge.exe	108
PID 3732 wrote to memory of 4544	3732	msedge.exe	109
PID 3732 wrote to memory of 2448	3732	msedge.exe	110
PID 3732 wrote to memory of 2980	3732	msedge.exe	115
PID 3732 wrote to memory of 2980	3732	msedge.exe	115
PID 3732 wrote to memory of 2980	3732	msedge.exe	115
PID 3732 wrote to memory of 4700	3732	msedge.exe	121
PID 3732 wrote to memory of 4700	3732	msedge.exe	121
PID 3732 wrote to memory of 2888	3732	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ww38.store.segurosmonterrey.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffad0a8c188,0x7ffad0a8c194,0x7ffad0a8c1a0
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,4024864145374958291,1040751274349969511,262144 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,9761810615251805485,10508128790548928903,524288 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,18334747621801208663,9632777109621194327,524288 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15424100824605813446,16410943725851980995,2097152 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,8071669036073882845,15816948192791107520,2097152 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,4712217386045651846,16533339961035164788,2097152 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,14537063511408415258,18005336366700976671,2097152 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:2
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,3998909438907648216,16572088078546711225,524288 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,10795858817854189037,7547179117235372123,524288 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,18295499550866137829,1789378077224357066,524288 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,18295499550866137829,1789378077224357066,524288 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4748,i,2518452562838837487,1567261606526074301,2097152 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3448,i,2934669224782941418,15122401691629642381,2097152 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5072,i,11205553518827111856,5186739409274169366,2097152 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,5242285541544123351,5110617335287702714,524288 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,13304382588494397341,15709217381804261137,524288 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,10122684476088612101,4952245471543371186,524288 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5292,i,831977442684414802,7379726462830707009,2097152 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,13180536068875059174,12025453107241758932,524288 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6156,i,15980214228011760310,3540638882428092498,262144 --field-trial-handle=2168,i,8791353740486696141,7121294849374514879,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 1981cb353dd29b9aed38a706ac0cb50ff1a274314216f47f1fb5e84161d6e11d
MD5 4428a52affa87cc62959c6ff42330457
SHA1 eee8952d9a0611d278d3bff5f318544f348edcf0
SHA512 399d202c985a61b0617dc92b105feb45ae1205bdcb55f6d4f0b5b36d80ff27147df1b05bc135225141547bf66d831b96174488874784ba1d160b0806b3c1c58b
TLSH
T1E5413120426F4081EF5006B166E221C57EF0E51E7DEF9F1F61745976BA0EB5A4823ED8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 d340c6b702569707cbf289384494cbd99192591f570f3bfdf283f08a48ec22b4
MD5 8bf22fead90700eed65346d9a2463c85
SHA1 c781fce44f1bd440fd62106f4153316ca43fe089
SHA512 7b433f72349834124ae94f6c05eedd928d79354ca9615b131c7d00ae03060f2f3044680ada6d4bd555f82247ee19765178822ed5f6822041dd7177fe278fe977
TLSH
T11C31FD10066F1141EF4405B266E212C43EF1E54E3DDF9E1FA2646A76BA4EB164C17ED8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 9be535ed568a139bb3c90f462fbef0d4a24f7fb433d850ace4ade58aa039e9fe
MD5 e7ce002f545c1479c095bede5395d736
SHA1 9b4bab34582419ffe485f5978251561e29e5a31b
SHA512 32970eca102e80ec13686c191925853583297d9a92c4ba912c5d8db06a0d4c1379bba90aad32d822f011b393de61f0c64f385ff348a200ec7c79eae0acb1ce60
SSDEEP 1536:TfEEjWlttjpGZqW3ynPDuVLpBO6CvBcZs862UqPq:gLlEt2BmNUH
TLSH
T180B36227D6A64C6B01F16264EC754383F325436F9286A82F3A3C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 7a87c644166a213d598f0abcd1291359da29a7b8a207b3bf1693d4e2a3614080
MD5 c7498e5800be132f0d46b5fad5451c6c
SHA1 688d901d92bd37a538aed93f05103b228fca4e9f
SHA512 117e13faa02cbee9f521fe84e450378be9345f46f0eba1844c32a7566cb3320882d34b980258eb75f45a2dd7b2dc873ea73db8800770a6c5125287dde127fcfe
SSDEEP 192:Dr10+rb7cLgyEj6pGkWoWnZKuBqlJ9/PtMfCtgA4W:Dr10+rfcLgyEGpGkWoWnZKuBqlJ9/FMw
TLSH
T187D16ED3D3F4466D8D1662F0AA286E17CE5E0919437C3D8AC7E8BE0B57F24B0D251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6db3d58e467219a6de2782446fb587a350aedba0c1a7cbe319f411cf7271dc6b
MD5 b136b680a807cb7d6517a8e815b82651
SHA1 aaa222db0ca968d95317605c0b9d946bf05f65ec
SHA512 0341af262698db571b3b8ea2b9ed4c56713f8602cec77de58abea73bf9dd47cb64756f2ca806f07d1409c2a272064e93325123d7c874906eabd3cb4b8afc16fc
SSDEEP 192:sxZS/ywFaKOMl8Mk2/f+sBrPWwIupJHAC6+WNGY9Ioc1uIgrJ:sxZSFM2/f+sBrPBJHAGm9
TLSH
T10142FB166B345977CCCFD209FA55BB53D6F54972A2940E48AAFCCA0C04E6BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 49f7d82cd560d9778bf6aadbffb57ebfc5e64bfc35fe4ab71577cf005c9aa729
MD5 fbc6149742401a0406f3a591069922c1
SHA1 bc1eed28bb80c626d6ce656547719fb86ed5d848
SHA512 5ffae06cc866955675b95efabd4941ea95fd3ea2d4eb9bc261b3a7be823f76ca8c9635d30905b31f6fcca25347341086cbc0bebf16dd0dedb1b034a8ebb15637
SSDEEP 192:sxZS/ywFaKOMl8UQzk2/f+sKr+twIupCsoFHA26+WNgKKXY9IBHbuIg5XJ:sxZSXqY2/f+sKr+SkHUAX8f
TLSH
T14052FA269A345977DCDFD209F954BB53E6F54872A6514E48AAFCCA0C04E6BDC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0b0a24861fdafb069e8beadbc9d91abdd3f77c3bd3cd30dd056b75f979749a53
MD5 9cd973a4c9b6b7f94475bd5738a74529
SHA1 97c60cbfdb135932877c674ec40fd610e2a4cd11
SHA512 f98b389e8e67ee779ed9c75a98932a902ad302520015bb66bd8511d713730b4723a613435924133f8122e342762a1575a72bdaa1c343eb82cddb0c9979cdd16d
SSDEEP 192:sxZS/ywFaKOMl8Mk2/f+sKr+twIup69HA26+WNgmN/Y9IXI1uIg5XJ:sxZSXM2/f+sKr+SKHUv/hf
TLSH
T1F152FA266A345977CCCFD209FA54BB53E6F44972A6514E48AAFCCA0C04E6BDC320381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7bb399cd8dd08c548814c078a7f98f24d61e46dd366f07aea896c68bb269e289
MD5 135b422b7617218ec980f0ce1f483a7f
SHA1 f5710ef4cc6f440147b1ac5602c51e6601c4328c
SHA512 b885482f4d7df0730d011731903e606974eccb454d2035d0dbe9d5f893f3ed51fca4e0cb037ebe8bb5257d5d4a656571fa2982870dcd21f51c8d3f8d6a66251f
SSDEEP 768:M/cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsFLlwmWNfroAgfP:M/cv21wWvu+Z+u1jahFLeRNMAG
TLSH
T104D20A2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA894C02C77EB511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 75496fb5cecc9844bec464f6e563686bbd0d511247baa768f5a901f54af6749b
MD5 a1930281f866daac8c762a9e47a6591e
SHA1 1fc216bdb079e81ddefe9fd206f2dabc0815cf72
SHA512 6f533a79bfb5f192d1262f49104dfa799adee6a231de2e0d97400fc250aa87f89fe8000ae8f286647797b570d14eda13298d5a9f97b55ca9d95d555e7e321d88
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDuRmKqgiOjGKw0Cg3Kjn1pNkdp4PDfkKrBY:mT9xplg3Kjn1pN0p4rfLBDtEHnY1S
TLSH
T1BEC13F13717A0606393D2858F76787378F8236737418A5AF7BB810A51E2AE621DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e262aad2-9eb1-4077-a8a6-6d262ee1e7a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e262aad2-9eb1-4077-a8a6-6d262ee1e7a8.tmp
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 13547e5e407e89c79b847b60c092294352b85211ef04a9eaf9d657e3c91c7869
MD5 72886ca33cf91341b4adcc2611a1e249
SHA1 794e36071f5fdf9b4f181adb28a10424485aa1af
SHA512 6c215fb73505f68855e56713d15dbd996d135c67a2c9a14a9327dfafaa9fa040e55248a5094b41568f96b902ec10c5236906ab7b8c12d5c6722bba3fd45c4797
SSDEEP 384:notNn/s3n9SfsNnsBziNr34e+CzOGRS+gfOObjI9G6w7F:oj+9Up43LbOGMBf29MF
TLSH
T1C9928D32AC394D7B49E2C154F58B3A1B9EF8417BC6862F84D1DCAF0D06EF6AC1305915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 300c9848e4bcc09e3e75fcf547bfedf2be75c1ac45cbf1581f8d33c61e22f53a
MD5 9237bcfd28061c26c86f498c25dad0f8
SHA1 a33505db7f5c6afd809480517a4a0dbb295964a6
SHA512 a57ace41ec3178c8832cef65e14a8cc346a618ff07c7db332b04596607a6f161f735bd3ec3d80aed829ca79bd16e2e029c52c6155047f37465327450a08a699c
SSDEEP 384:YH67F1tNn/s3n9SozsN58TUNTUlIlpBziNa3J2e+CzOGRS+FfOObjI9G6w7F:DF1j+930wgNl3JBbOGMmf29MF
TLSH
T184C228F258D7497AD9AE8B57B77E2D168EBCC067B5816A40B3885E0CCD9B1BFC305800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bed07073386d1fbc0eeb44d41133354301568c9e2cb7173b00c771b32401dd95
MD5 67fec217b8173c92d1d1cbf62d35e66c
SHA1 515506a6208c2066f9e1de36cbe1335e1237dd2a
SHA512 47a414c42f466149cf294902fbfcf1ef2d2eeddfbc4848b5aa3ff452aa653166ff63a3dcef9ce153b926a049ad51c92546dcc1f4ce2a18e0a3cb8e5f4a9ea4b1
SSDEEP 384:QotNn/s3n9SfsNnpBziNr34e+CzOGRS+gfOObjI9G6w7F:Jj+9Uu43LbOGMBf29MF
TLSH
T1E2928D32AC394D7B49E2D154F5873A1B9EF8417BC6862F84D1DCAF0D06EF6AC1305915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 41c5584e81e980285af50fde1f10f15835cac311a50925dd34ea9660ffe578c9
MD5 8d8a9c43a64886ea60b9fe1462c3e02f
SHA1 685909eab275c620c2f8d83048c04b08b237512c
SHA512 4c851496935f157d68278a49f2fe3f522155b8c0f8ebbbcb2cc3cf32c02e0f0adfacaaccaa228acaa1a977f3ce9317f15d7889eded961eb8899219365272e556
SSDEEP 192:nONK6v+YL1QmiUyXR4h+CGmOCRvcsFS+fCHVrqeU6:nONK6vzXS4h+CzOGRS+0fU6
TLSH
T1FA123C36B8785C7B5EE2A541F48735179EB54137EA867F80D5DC2F0C06EF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 48ccc9ef0629d922883b73db805fa11fa4622b91b8cb74b38762ac83ff02bdcc
MD5 3bb18bb1d845f1c0064485d941ba2a5f
SHA1 9a50d499668e2bcfd161f94c6c9cdef488113ff5
SHA512 590a86daeecb9e927e477b114e7b47e73c1b3b3a5af61a313d60ec201729a1c44eb97cb7d4cbda0fb7eae0e888fdae808db2e5a7d49a9b9930731826fe6cc418
SSDEEP 192:JONj6v+YLNQmiUysRZh+CGmOCRhusYHU6:JONj6vz/TZh+CzOOCU6
TLSH
T15102E935B9681C7B9EF39E45B54727275FE8203BE9962F90DAD82F1C01D764C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a44d0e9-d997-4f8d-8188-08940e171788.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3a44d0e9-d997-4f8d-8188-08940e171788.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 672c67038a3f59cda600cc80f1546a5ad0e7ef40550dc3c8a7329c7b04e8d176
MD5 8ea8d701ab2efe96575b7aeeeec58dcc
SHA1 c84f08be575fa073b00a0895be3f74d1c5885421
SHA512 5d529e5c0276d0ad9177eba528a166c6b2a3de1d5705aff222befef6bd42d8d6f46216f4f5c42a2c09f399207b2edfa12159c4c7995585536e6964a80d878232
TLSH
T1F2412A58A6ED1108B3B76F569BF6A86E44BFB9772E16D05D10110E4E0A22B00C872733
MD5 SHA1 SHA512 TLSH

Submit Download