518f329d59e3ab92f46064add64cd61aa73862cf0cf37081b99af2380ac6bfe9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/_1024社区备用网址.html
Size 1.3MB
Sample260720-w245mac14x
SHA256 518f329d59e3ab92f46064add64cd61aa73862cf0cf37081b99af2380ac6bfe9
MD5 77d8030e6ab130d612e2fbbe896dbd33
SHA1 94bcd98aac314e2e3088515e9ecc82de9d040475
SHA512 fc30b317253da5acdea37b39ae444e15a86284fc260459aec5d7081102aa4b607424558686eaeb58a71b8474f49184353cf7b226aeea30d04c92c25e4db49707
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++P:Eav2F+YhwIT
TLSH
T10D550051D81A40B271CE05A23EAFE25E263D7A1B9FCD1B494D2737EDE07260DB09CC92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1992	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290456009545687"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{839DE913-32C4-4860-8165-12619611D0E1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 6116	4688	msedge.exe	84
PID 4688 wrote to memory of 1992	4688	msedge.exe	85
PID 4688 wrote to memory of 6012	4688	msedge.exe	86
PID 4688 wrote to memory of 6012	4688	msedge.exe	86
PID 4688 wrote to memory of 6012	4688	msedge.exe	86
PID 4688 wrote to memory of 4916	4688	msedge.exe	87
PID 4688 wrote to memory of 4916	4688	msedge.exe	87
PID 4688 wrote to memory of 5760	4688	msedge.exe	88
PID 4688 wrote to memory of 5680	4688	msedge.exe	89
PID 4688 wrote to memory of 5760	4688	msedge.exe	88
PID 4688 wrote to memory of 5760	4688	msedge.exe	88
PID 4688 wrote to memory of 5680	4688	msedge.exe	89
PID 4688 wrote to memory of 5680	4688	msedge.exe	89
PID 4688 wrote to memory of 2804	4688	msedge.exe	93
PID 4688 wrote to memory of 2804	4688	msedge.exe	93
PID 4688 wrote to memory of 2804	4688	msedge.exe	93
PID 4688 wrote to memory of 5180	4688	msedge.exe	101
PID 4688 wrote to memory of 5180	4688	msedge.exe	101
PID 4688 wrote to memory of 5180	4688	msedge.exe	101
PID 4688 wrote to memory of 3928	4688	msedge.exe	102
PID 4688 wrote to memory of 3928	4688	msedge.exe	102
PID 4688 wrote to memory of 3928	4688	msedge.exe	102
PID 4688 wrote to memory of 2432	4688	msedge.exe	103
PID 4688 wrote to memory of 2432	4688	msedge.exe	103
PID 4688 wrote to memory of 2432	4688	msedge.exe	103
PID 4688 wrote to memory of 876	4688	msedge.exe	104
PID 4688 wrote to memory of 876	4688	msedge.exe	104
PID 4688 wrote to memory of 5032	4688	msedge.exe	105
PID 4688 wrote to memory of 5032	4688	msedge.exe	105
PID 4688 wrote to memory of 5616	4688	msedge.exe	109
PID 4688 wrote to memory of 4540	4688	msedge.exe	111
PID 4688 wrote to memory of 3364	4688	msedge.exe	112
PID 4688 wrote to memory of 3144	4688	msedge.exe	113
PID 4688 wrote to memory of 3236	4688	msedge.exe	119
PID 4688 wrote to memory of 3236	4688	msedge.exe	119
PID 4688 wrote to memory of 1188	4688	msedge.exe	121
PID 4688 wrote to memory of 4152	4688	msedge.exe	122
PID 4688 wrote to memory of 4152	4688	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\_1024社区备用网址.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff97c22c188,0x7ff97c22c194,0x7ff97c22c1a0
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,15673427050903224644,12210442867224894773,524288 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,326842996131675251,12308863959486395122,262144 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,8574547838893723805,8954791280019712383,524288 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,5095863676242493756,12783998191016901634,2097152 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,10263320895431479432,8323986360644411639,2097152 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4976,i,1675189127021423216,13716755453343990812,2097152 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3440,i,16476197454528358644,6950037304008910832,2097152 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3540,i,9862293362840981631,7637096789291272880,2097152 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3516,i,1402027863399584058,6624663668600538375,2097152 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,14967031114992948913,16836812596616861956,524288 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,9449734165916092308,161751394064142200,524288 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,9686635685709071144,15409429973291677786,524288 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,9686635685709071144,15409429973291677786,524288 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,13885102205564362077,13656072239041958435,524288 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,18190426481634289889,13217761023181582923,524288 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,11636878880966921755,15685626783856269931,524288 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,7160981798382360682,16899488226006207543,524288 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6104,i,18031721811146593507,14672023745208142697,262144 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,2715119317859000624,15269080040906189544,524288 --field-trial-handle=2112,i,10513522088182334211,3019817808655173840,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0b1fc9d8ca628dc5eec82fd95ff7292d9d7d16cdc46194f728385a5f2c43e118
MD5 2f0a78f1d62e7f52172b5eca0a2a383c
SHA1 5d537902dcffc272e8c5449e2c1b6290a4d403c4
SHA512 9f985e6c8cad5f5038ef2a3a570fabce7ce41d4411839485fdb5592a1b3e8ca53ac0020f34ffa862b0c99dc6702224da079ae9715f83534c5996c29e74e8f528
TLSH
T169E02BBAE821EC2708FD071860195757E70013573A814A5F3A3C82088FF4A2A46C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8c2ae4b7534dfc0d2718876ef06be513f90b004ca4831223180fe074ff1fe73c
MD5 31a6f46d8dd8b9ae84ff5f57b2dfae3a
SHA1 c8b3745153a2cbacae7b20f26ac7e035d1649dc7
SHA512 e4624450d9412ec1ab144adc9f3be154fef58c77078fdae2677f3b4d1132ae14e36473d0cf43ca80c29b428d191aa939057c0214b129f3a30cc89e76cb6fef16
TLSH
T17C61E93E9D0F02AFE319617169D10544373EDAC4FE936F860192F5342E09BD5F0D6154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595327.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595327.TMP
Size 3KB
SHA256 fa0e4ba241981730e40065ea5e4bb9187802fc0dda6c68e5010c03f857397a63
MD5 bae17651969353623fbb43dda6799b7e
SHA1 bdfbf17708bd88ce9e41b6e4c9105b88bf3b9ad1
SHA512 1708685e306ee4500d262c96fcf67ee2b4982744a77c4799badd4078354a33b3233db63c418d089f5628d6c3a8d50365e5300034af161197063a4f32fe5c43f1
TLSH
T15561E73E8D0F02AFE31961B169D10648373EDAC4FD936F820192F5342E0ABD1F0E6254
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b88c867b6fba2384dbf08d0656e66c3b1a9fe8e0495c16c429787ef782cd08d4
MD5 40fabe0a25cbf493c3617b3a1a3e96ee
SHA1 68b1f4f4352ab33903d71343420b5c43740fd7c1
SHA512 b76e29a5435f96cc65202010613b05a46c2626d05e29b35fb9a1a91a2fbd214500e90ef3034e010df70705dfb1662943aac880a5735127ef93f58eefdef12e57
TLSH
T1CA41CCF783F4856EDA0196F0AA18AF2FCE6D0551832C3D5AC5E4AF1B93E2470E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 edd8ec5532c30342fc46d54088b18f62a4a835a38231718c62523bf8b984da52
MD5 a9e38966d86d6f00a5bab6b51d4280f2
SHA1 285fa1d88f40b411610f9a2c0689650275f7a09d
SHA512 50b19705675acc4b6bb2ececd24f77ed92f5e21b0f5ff17d6183e3015ea47557b595e00863ae4316b0bb281775dfb3bd0a186783c74f413a3f8066a2de1b58de
TLSH
T18241CFF783F4856EDA1196F0AA186E2FCE2D0551432C3D5AC5E4AF1B93E2471E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2f9fb50ddaa8a35a22ccbf33d69ea10a11db2de617cb06b2c76d9e63756f9094
MD5 659a36e1646b40b94bae4a7f79a0527d
SHA1 2a557ac6fdea00233de07d65ee3923f574a30d5f
SHA512 3d4f24ad271fa42718effa7dfd83c633d4655fde8b444e16a1a437bf19b8e7ae5874d6231d3b7e5283b066d6026dc3c89797d5501c76f0d855c422f8a12a9a6e
SSDEEP 192:sxZIFbERLEyMqZjK1Ml8MkbP/f7JsbhufskZdpKJzodpHIhIiI1HW6+WNGYv2IX8:sxZBNMb/fVsVufNzLRHbGatCj7
TLSH
T1E062E8166A345D778CDBD219FA55BB93D6F90173E2904E44A9FC8E0C05E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7d438299abbe0d1a59846c46ad6c855de2c2ac2db8274b8fbf72338a19a767d2
MD5 d98160b30fce1209fec2d0863a6e9aaa
SHA1 c99403a8474cd9b196a9fe85c3e4aec8d21f9d65
SHA512 af52b66d71fa3a759a40c0f54e989ba87d12d2c6c43343e1d4abbecd11115f54f83b792e47df3d8a4f69bdca81bb088aeb620057e7fb329696272a2c7de9faa6
SSDEEP 192:sxZIFbERLEyMqZjK1Ml8UQbWkbP/f7JsbhufskZdpKJzodpHIhIiI1HW6+WNGYvH:sxZBNqBb/fVsVufNzLRHbGjtCj7
TLSH
T11C62D7166A345D778CDBD219FA55BB93D6F90073E2905E44A9FC8E0C01E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 308089aaa44a937d70c2241262bd7f5379308eca58988d30ed522e2ff3efbfcc
MD5 db02592b943d3f32c797e37f569c0ce9
SHA1 124832c2d1d5fcbba7cae68206489e3d63128860
SHA512 2d4f77e2b36f38c6ab04c4ae52a5af3da4d1b86e20620dad3971838f33426c1d2a5ce505aca1e7b921fe3fd541d4686aa58b6405e27985d9327dd1df7e8be1c3
SSDEEP 192:sxZIoERLEyMqZjK1Ml8MkbP/f7JssbufjaZdpVJzodpHI4HW6+WNGYvIC+Rb+DIc:sxZojMb/fVssbufjazKFHbGrtCj7
TLSH
T14A62E8166A3459778CDBD219FA55BF53D6F81163A2904E44A9FC8E0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 44835472fd763e8dcef32a5d505b7bbbf7da8a96fda8ab8b71737aef9f99156d
MD5 226218e406b42ee19be2bfdbb3664807
SHA1 acd2d3292f65ad6fb1e75edc10a07fae7d8fba55
SHA512 1702783c5516fa97a219ec21dcf5862de917fffc8f1f782e74b383095674b81adfe1c56ab388ed7072a2ffffdbe23ea986d61a2158feafad1bed19400b9e96e0
SSDEEP 384:0LppY93PBZJPtN531A5sAe+OrWXwQ4nqSnwYfqAFdu/DFXHqrQnLRkqVI9FYrM:0LppY93PBZJPtN53JpX
TLSH
T178B27C5A713E0211393E2988B39696364F4235A37058E4AF7FB814A54F27E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f9f003c2fe0d5d799a7448297b0145a110060ed362ac5335a602722c401ba862
MD5 3e0a308280cb52644fa638a007be9b6f
SHA1 824e49dc4e5cb5bac93758959db05d230fcad737
SHA512 d180df1b4cb4bc6459ecde21f27843a9470cfd357a3e188a4ccdffb394557695bf70c77f79f0d2b809ce3f29b9f51c84ae4b6d2706cf7f9f8d26719f27a7ecf6
SSDEEP 384:nWiF1tNn/s3n9ScsNb8TUNTUlI4mJQckCrzXEOpvBftGp+Mgj4Q4L1AtUOObjI9W:9F1j+9D6wg3k2EwjGPVQ2AtU29MHD
TLSH
T1BFD25A36E864CA6BEDE74BC9B70A3A57AEE042A3C5CC5AC8D9D81E4C01D75EC4307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8b16e8fd42be1216529ad463c3a4bdc4c1b8dc4fb8ccf35f5a5d99ed16d83640
MD5 58a0142c80d45ef687cefd3ea71356c3
SHA1 f217fd5d728eb737ce8f68a6686e4e907e7490cc
SHA512 b6a235a219ed3680b13fbb04441bce98b3376b415363d3ba08be523bc328afe11931be376e0b22e2dd627319f8c6c7b499cf5d0b8063799511f859023360962f
SSDEEP 384:npfiF1tNn/s3n9ScsNb8TUNTUlI4mJQckCr+XEOpvBftGp+Mgj4Q4L1AtUOObjI8:pqF1j+9D6wg3kpEwjGPVQ2AtU29MHD
TLSH
T123D25A36E864CA6BEDE74BC9B70A3A57AEE042A3C5CC5AC8D9D81E4C01D75EC4307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 65c5f4272ecf91d327244577a4bf28e51738ac0c888a0536693d968e75c68fab
MD5 e9d360c28d38b86adee4e1188da43a51
SHA1 8e31dd88911a9cd8b444a8ac9761bb993412f92d
SHA512 e01ba09f5dc390d67254b104bf5a3b042443d2236b6477b3f70c05a898bbc2e540573df1a84e7579215ea73986cc9ce5ae1a5dca78bde7a31eef9d3caa3ac766
SSDEEP 384:npfiF9CcmyWCs3sNb8TUNTUlI4XQckCr+XEOpvBftGp+Mgj4Q4L1AtUbty/7IgnI:pqFccps36wgokpEwjGPVQ2AtUmI
TLSH
T134B23836E864CAABECE74B89A75A3653EEE44163C6C89AD4D9D81E0C01DB1DD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 c2963344be028d3cbf2dedc07f65b99cb83adaec9b6b7d9d24cb5917e2d6b8f1
MD5 ccb99706c7ec210a0ac2fbd5b3b7397f
SHA1 558e0768a81f6e816cfdee7ee930816113b04dd9
SHA512 c3d9983965d0467f174f0bca9abddf33cd1b14bb5d34b4e1a5018a0de1f1fa8477a32ada153fdea49c6f8526aa9ab4e7db525571e03840d368de5057da21de31
SSDEEP 384:nppiF9CcmyWCs3sNb8TUNTUlIm2QckCr9lMKpvBftGp+Mgj4KKphe4KV8p0PHTt+:pAFccps3iwgbkUikjGPVKCI8p0PU
TLSH
T13FB25C36EC64CABBEDE74F89B74A7A03DEE0126785D859E4DAD81D0C00D71DC570B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4657ce267485c5c02751f3cc892bcb22e0f9c80a9471d0705718d00a127d63dc
MD5 6289244cc2ab827406745256d721f5f4
SHA1 a947138c43de4a63e68576b478e10766b7ce30ae
SHA512 0ecf3ed75db53777a2218a19d02bb4f46ba4c625476e83b83d0376d94a7d162495d81d49d49d7548c710f9e88f51842e65e27ad18c855f8b041ee9f07f225c32
SSDEEP 384:nviF1tNn/s3n9SRosNb8TUNTUlI4mJQckCrzXEOpvBftGp+Mgj4Q4L1ntUOObjI8:6F1j+9h6wg3k2EwjGPVQ2ntU29MHD
TLSH
T14ED25936E864CE6BEDE74B89B70A3A57AEE04267C6CC5AC8D9D81E4C01D75AC4307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c4c438fcda2900a97247953ea00ae4165e417e874e6a3c42294bc38afe244072
MD5 70f11e6d883fe211c3c6e74539ab05ca
SHA1 c97ae09d5ff12f9aa222260bb33ee1588238764c
SHA512 0b22161e80d32b95a7ffe1baf08bdf1f40a1f9eddf1682ddb0da17efa38705446897371bfc9643d70e58f1c7e2ed37090ed7dbd59dda982ce4fcc222c517a31a
SSDEEP 384:npliF9CcmyWCs3sNP8TUNTUlIm2QckCr9biF/pvBftGp+Mgj4Q4L16tUe4KV8p0M:psFccps3KwgbkUmFxjGPVQ26tUI8p0PU
TLSH
T117C25B36E864CA6BECE64B89B74A3503EEE05263C6DC9AE4DADC1D4C11D71DC530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 09b6d8ff159f056bf2508d4a0b0e084399a0ef02563cc37b0c227012cb870bf5
MD5 956e2b5588efd4edcf4b1cda9cf83bec
SHA1 bc1d9738a28c30589bf097d24c1c3fd6542e4f92
SHA512 76a4a45a44d52362ccdf0ca8cab6fdb0ab2a817ea1e523ac75e359f886c200097957344dc60fc23ce94ba03e428594e2f935bbecaae55ca78db9c2a6dd11f961
TLSH
T1C0411D98AAF91148B3B37F5AAFF7A56D447EBC731E0AD59D40110D4E0667B40C8A1733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5616-230-0x00000201A7EE0000-0x00000201A8EE0000-memory.dmp

Download