hxxps://click[.]ngpvan[.]com/k/135733338/635156900/150072658?utm_source=email&utm_medium=emaillogo&utm_campaign=BCom_TargetedEmail&nvep=ew0KICAiVGVuYW50VXJpIjogIm5ncHZhbjovL3Zhbi9OR1AvTkdQMjEvMS84ODM1NCIsDQogICJEaXN0cmlidXRpb25VbmlxdWVJZCI6ICJhN2VmNjIzNy01YTg1LWYxMTEtYjMzNy0wMDBkM2ExNTU4Y2UiLA0KICAiRW1haWxBZGRyZXNzIjogImNyYWlnZGVzYW50b0BuZXd5b3JrbGlmZS5jb20iDQp9&hmac=HHjUagMvm5vZRc3edmNvp4VDhW41_hpmu31UmsVeF-I=&emci=93ef6237-5a85-f111-b337-000d3a1558ce&emdi=a7ef6237-5a85-f111-b337-000d3a1558ce&ceid=37067373

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://click.ngpvan.com/k/135733338/635156900/150072658?utm_source=email&utm_medium=emaillogo&utm_campaign=BCom_TargetedEmail&nvep=ew0KICAiVGVuYW50VXJpIjogIm5ncHZhbjovL3Zhbi9OR1AvTkdQMjEvMS84ODM1NCIsDQogICJEaXN0cmlidXRpb25VbmlxdWVJZCI6ICJhN2VmNjIzNy01YTg1LWYxMTEtYjMzNy0wMDBkM2ExNTU4Y2UiLA0KICAiRW1haWxBZGRyZXNzIjogImNyYWlnZGVzYW50b0BuZXd5b3JrbGlmZS5jb20iDQp9&hmac=HHjUagMvm5vZRc3edmNvp4VDhW41_hpmu31UmsVeF-I=&emci=93ef6237-5a85-f111-b337-000d3a1558ce&emdi=a7ef6237-5a85-f111-b337-000d3a1558ce&ceid=37067373
Sample260722-e7mn4adk2y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1620	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291685129796196"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{F21F2BC9-BF6D-4251-B659-E00727379C57}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3328	2172	msedge.exe	84
PID 2172 wrote to memory of 1620	2172	msedge.exe	85
PID 2172 wrote to memory of 3288	2172	msedge.exe	86
PID 2172 wrote to memory of 3288	2172	msedge.exe	86
PID 2172 wrote to memory of 3288	2172	msedge.exe	86
PID 2172 wrote to memory of 2084	2172	msedge.exe	87
PID 2172 wrote to memory of 2084	2172	msedge.exe	87
PID 2172 wrote to memory of 4656	2172	msedge.exe	89
PID 2172 wrote to memory of 1696	2172	msedge.exe	90
PID 2172 wrote to memory of 4656	2172	msedge.exe	89
PID 2172 wrote to memory of 4656	2172	msedge.exe	89
PID 2172 wrote to memory of 1696	2172	msedge.exe	90
PID 2172 wrote to memory of 1696	2172	msedge.exe	90
PID 2172 wrote to memory of 3040	2172	msedge.exe	91
PID 2172 wrote to memory of 3040	2172	msedge.exe	91
PID 2172 wrote to memory of 3040	2172	msedge.exe	91
PID 2172 wrote to memory of 4456	2172	msedge.exe	92
PID 2172 wrote to memory of 4456	2172	msedge.exe	92
PID 2172 wrote to memory of 4456	2172	msedge.exe	92
PID 2172 wrote to memory of 1688	2172	msedge.exe	98
PID 2172 wrote to memory of 1688	2172	msedge.exe	98
PID 2172 wrote to memory of 1688	2172	msedge.exe	98
PID 2172 wrote to memory of 3952	2172	msedge.exe	100
PID 2172 wrote to memory of 1476	2172	msedge.exe	101
PID 2172 wrote to memory of 1476	2172	msedge.exe	101
PID 2172 wrote to memory of 3952	2172	msedge.exe	100
PID 2172 wrote to memory of 3556	2172	msedge.exe	103
PID 2172 wrote to memory of 2792	2172	msedge.exe	119
PID 2172 wrote to memory of 4748	2172	msedge.exe	120
PID 2172 wrote to memory of 2688	2172	msedge.exe	121
PID 2172 wrote to memory of 420	2172	msedge.exe	124
PID 2172 wrote to memory of 420	2172	msedge.exe	124
PID 2172 wrote to memory of 1608	2172	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click.ngpvan.com/k/135733338/635156900/150072658?utm_source=email&utm_medium=emaillogo&utm_campaign=BCom_TargetedEmail&nvep=ew0KICAiVGVuYW50VXJpIjogIm5ncHZhbjovL3Zhbi9OR1AvTkdQMjEvMS84ODM1NCIsDQogICJEaXN0cmlidXRpb25VbmlxdWVJZCI6ICJhN2VmNjIzNy01YTg1LWYxMTEtYjMzNy0wMDBkM2ExNTU4Y2UiLA0KICAiRW1haWxBZGRyZXNzIjogImNyYWlnZGVzYW50b0BuZXd5b3JrbGlmZS5jb20iDQp9&hmac=HHjUagMvm5vZRc3edmNvp4VDhW41_hpmu31UmsVeF-I=&emci=93ef6237-5a85-f111-b337-000d3a1558ce&emdi=a7ef6237-5a85-f111-b337-000d3a1558ce&ceid=37067373
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffe0041c188,0x7ffe0041c194,0x7ffe0041c1a0
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,12101993750415724065,11008250587052931034,524288 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,4093543905076605929,3385559505321524910,262144 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,16172903592118674751,16154840677669198282,524288 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,7608823629857344413,2461671365268459828,2097152 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,14677286948014118848,17977776357392892180,2097152 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,4989554378808163937,5835429824505672573,2097152 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,12163925089525924722,4318103043776857349,2097152 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5108,i,1086052928653040710,1849887117813008479,2097152 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,16319449004773883487,12981445023343424372,524288 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,16772838627588517282,8630496622858523034,524288 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,4286260223505704517,9912428903757538777,524288 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,4286260223505704517,9912428903757538777,524288 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,17590301277660834101,8382466640039753403,524288 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,4170746666243059569,9811565293956604974,524288 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,9086763627457578505,853137100336126323,524288 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,9826737879667282175,14754463813833239820,524288 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6432,i,18443955129606995356,6399875716922142358,262144 --field-trial-handle=2548,i,1123854254345627716,10519030037443911362,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

1cd86e4b-5393-42dd-b585-e2ce5dd3781c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1cd86e4b-5393-42dd-b585-e2ce5dd3781c.tmp
Size 30KB
SHA256 305b8e3cba84084bec42583728ecccb03fb3248ad8b27de716b2945e4967a49a
MD5 ca90d377242e8dfc76ae4904b94f3310
SHA1 db1c3b869e23e20d17bb3c6a9a73e6cf40d31e8c
SHA512 54490c2ddd689f6f18530c515f507d1a54c082af625f9357f31222d3ad68ba7edb94f45f09eae13be82bb73605c00f17a0b0a605b925dc6edefce313041faa28
SSDEEP 768:moseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppVrois4:moseJ3xWvhfynu1jaVcL88puin
TLSH
T1B8D20B2B680CCB7E4F844E6DEC266F966EE801CB57984D5487EA880C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5ac2a2bfd82100ba36b6e0e4cd277113f00bff18c44b432248713708b17ad7c9
MD5 97e7560af7846d2225c7a88e399d4f08
SHA1 003993c1481269dce36249a3ad74cfff5c49c6a6
SHA512 18278dd7e154cc4fab8b0b9ec0c7c3161c03d2f47a533df226e96da75808870994ef2371f4cf97f8743d79aa25104aa0fe476311d09cdf0a567df565b879708f
TLSH
T15E815FBB0BE1E47AE7D1087161DA6905303DC2FAF807EE96F7D486792D0239681F4275
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4a1c441f82e14c3f5c3098b2ebc8ab4a1157d506dd393e37ffb0d54290b70668
MD5 363644ae0605bf9450f6e5a5c460170b
SHA1 da893f8cd8716a51977600045fbcd71023d07037
SHA512 ac12019684b474a7c0aa0bc7c3fe36df482f4652737e8f4587baf08bec891c97e1bb3c1939041fb8a1d3d4c5efa9f99c2af661e63b7d96ec0cfaa7598811aade
TLSH
T158714CBB07F1A8B8E3D04872A0D25541743EC2F9F817EE9AF7D085B91E1172582F81B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b159.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b159.TMP
Size 3KB
SHA256 9eb7f10731e9baf0cb24dd2f45131725817cc572d61d9f5695f2d00f42a09949
MD5 f8805982b9e38357ab1939248b152123
SHA1 fb414bbf778dc81b38a8929a902dd592ed64f5e8
SHA512 9871a99830f2a90317fade757115db287159b42d951191ce7fead200f94f02e1e75f5c8c088195bbc42aadc1081de51608477b0d4a0f1f1e88b00e88e245a88f
TLSH
T152714CBB07F1A8B8E3D04872A0D25545743EC2F9F807EE9AF6D085791E1176582F8174
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9e911205e89777e7221850abb91e402eb86d308db4e2de6859c3ba947064b9b4
MD5 48639d8b0f1d319d8a7318fcacbf6266
SHA1 1cfb53465516d7255095990dede12656247774b4
SHA512 ada0a09361e702df4219af92793f9b4606d6a00d24680f45858ba5e35a18ad39d12c10e1acda00e28e6c3b8ff0a08ae048cdc25d48adc550a57b9f43d5c75661
TLSH
T1F05188BB82F5927D8A1616F0AA296D1BCE6E0550832C3C9AC4D4BF5BD7F2471D20164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 63b06a33e438f37e2ddcaef92552706c07a6c282cb65d9622ba3ebc621b0895f
MD5 9f34c6318e7ff7629579bb7331c81b9d
SHA1 5f351e21ce008d6d330137d69e9c1ee3d5c75240
SHA512 e4bf80422242b762863a92787590ee9dd2cfded75dbff59a8d912197d5cdc4dc36d35b988316ea20b09881314a7404fafb0587058113a8ab9b10c9701a6745b2
SSDEEP 192:sxZDPwRW7yM/jK1Ml8Mkmz/fGTsvBDJVWtIdpsD+HW6+WN5NDrXj/YvwjD5SWWGG:sxZ0eM6/fMsvB5nHb5t/RC9
TLSH
T1D942E716AA345977CCDBD209FA55BB53D6F51572E2900E48AAFCCA0C04E6AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3537a8688def018959d0919e5150d34414afa8dea68f2fe9609ff452bce7e224
MD5 4ad4002c3e01e94efff11dfd314f404e
SHA1 41e502c8531389774715eb804d633a2b4044c610
SHA512 002794748224cffa05bee52ba8377f6c6856e229f26ca3e7b06a33b246767ca0d85d9da0eb9828e4c85dab4588f1c6c9aea871d867231e08472310e51a30c0da
SSDEEP 192:sxZDPwRW7yM/jK1Ml8Mkmz/fGTsmT+wDUVWtIdp2D+HW6+WN5NDrXj/Yvw0zDoSj:sxZ0mM6/fMsW3eRHb5t/4Cs
TLSH
T13452E716AA345977CCDBD209BA41BF53D6F51572E2901E48AAFCCA0C04E6ADD2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 44038300b3ee8066e426234fb3388740e43fb44cf4ffa2135b445790a8a19b2c
MD5 45dd8afd688d7b2d74c67221e323dd49
SHA1 168d23c8886173407761fa915d05542ac578b8f6
SHA512 34e08797dc256d8a966c034d12bd875e87286ba055cceee527642386a0c3ea1dd8e287e6e9eedd27228387312b01e9b9dd7d2e4062c1a6decfafe4e52474bc77
SSDEEP 192:sxZDPwRW7yM/jK1Ml8UQmakmz/fGTsmT+wDUVWtIdp2D+HW6+WN5NDrXj/Yvw0zJ:sxZ0mqm6/fMsW3eRHb5t/4Cs
TLSH
T19C52E716AA345977CCDBD209F951BF53D6F50472E2901E48AAFCCA0C04E6ADD6217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2d71c3f08014b11123b30be82d6c9e285217514e04d3e07a79e11e17182a0c5d
MD5 c0e16b788599f60485f83a5082d1ede4
SHA1 587059a12bc5b42ac0a766f959af773de172e0f0
SHA512 40e62b2f8b417838e89def4a5b51b8a9edf716c7ac390345696418b6b2a5be7bfbe720d7f4f22c87b22118f6bcaa1feaa01cc52d00931f1619deb88956432ec9
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1Ea:KYHIhKggkXyi0InKxmUTyNrIlKkswF
TLSH
T14EA1801A343A0A1238BD3988B29195361F42319B3568746F7F7800620E6FD567FFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594d1c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594d1c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 2c6cee9af1d6af8be6ecf20a9747949ee9aeaa622ee18a57a97f4f7edfdb881b
MD5 09f08e03779be9bf5e6cfa4b3fc2626c
SHA1 b5c2761cea6fbed318837d08887dde637abbb795
SHA512 59b2ab9bfdcc639bce6c07994cf127f51e795226453b0cec0be95f6de57167c85dcb056123e3f426d1ea68cd9905760a61c96a3b31c37a873aabe2a828f9ea81
SSDEEP 384:btNn/s3n9SfsNZ/DX+DF7e+IWgQdExMdUU64od:bj+9U0KxKWXLUUbod
TLSH
T18D625B32AC385C37ADE2A586F44737075FF4816B96C52E94E9ED6F0C01DA66C030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 b1f56aa8994b93c95b3b101265fe5682f63860e2928b7cf38bc97f4d7a34af72
MD5 e849251c429a9faacee4ea556486235f
SHA1 1b20dae3129e8338d65051c2db46cfd71b2de9ce
SHA512 c3b9abdd558ab2f7dc5ecefbd59db42968ba2f4fbd55bb8c0b8728e4428a5ee1a2bd3e8b0d7b53e73e9defeed6845ca9deec7b29eacf6abd9803999d246375ad
SSDEEP 384:giF1tNn/s3n9SZzsN78TUNTUlIlMDX+DF7e+IegQdExMdU664od:7F1j+9KGwguKxKeXLU6bod
TLSH
T1C0B209F298D78837E9AE9747F77E2E025EBCC167B5806A54B7981A0CCC8617FC306905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 3ffe93de3b91c890364b18f7b5e25445d1113c445adf7b3cf54af82bcfa5dcf5
MD5 b2fdba98852668620d99bc4a2d3740ab
SHA1 1406bfc5a16aa47ce7fa1fadd532c804ffe86fbd
SHA512 2726bc601c954c9f6341745d91dcc365a8ddd6e9a2712826ec109b02ffc208ce40d51fdb92033a97a83700b470da61832361b632681b7cbad9c1b872327d2d1e
SSDEEP 192:pWONlC6vMyYPQmiUyDSTDQBp6hTQv+FdLYxTkFd3EM80Is9DqfU/u:wONM6U9RJ2A3dExMdUx64U/u
TLSH
T139121B31AC7498276D93B546F48A37131FF0926BDAC46B54F6ED2F1C01DA66C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 343c53fcdf69a509d21a36a23f86f7a2e096ba4ff660b25fcd8cd6f8b18843c9
MD5 68010b1edb04cd598906bb467e903c75
SHA1 055914aa6cb1fc549f8371173adb2258e58cc41a
SHA512 afbe57c316d41a8038eac0256be44360d8b49367dd63c66070e7e59d496dae6bc8892abd13d7ce61ab27f628ec9646e45ba4fb214c2a9b6dec5bfeb1b944ac34
SSDEEP 192:lONw6vMtPQmiUyDlDQBThTQv+FdLYx5847sd7U/u:lONw6UtR/T3dExBwU/u
TLSH
T127020735AC786C7BAAA3AD46F48A37171FF0516BA6D05B54EAE82F1C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 712ba873d3d635167c90ff2e7e84dbfed843b78888833396bb7b7982cbba1ec4
MD5 a4548e19ab6c4bda9771a40ea23622d6
SHA1 9a7c4b0b99268ada398712bf1ec6bb7de7e5919a
SHA512 fa2ccbd914370cb7f228f7ec18d9ee3aa91c44996fbe23040299c96d8edb6d06b764b59e80b07836b67b33877546d118ca0aa3716113909441fc51fe7983e819
SSDEEP 384:WtNn/s3n9SfsNZMDX+DF7e+IWgQdExMdUU64od:Wj+9UNKxKWXLUUbod
TLSH
T125625B32AC385C37ADE2A586F44737075FF4816B96C52E98E5ED6F0C01DA66C130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 429a093d7cc746ec4bce5b546aad7aa30c52d0869297debb721098110ab3085a
MD5 b4b7b941dff3c3ff6b0ced09646a292d
SHA1 668e48636878f20392b5836233d4bbb3e3533cc0
SHA512 d3fbfbbba1a9d780db779e85cd438d0be72d146bee18aca49d6167beba61c11eac7202d27670705595875f64ccfde204a0fde4ef23a2315c5bf27fe8a62586be
TLSH
T102410B58A6F91148B3776E569BF2A86D847F78372F0AD59E00110D4F0A63B40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download