82bbacfae93233ec16171600a82022eeb6b71227ca311f5fff5c967219d6f20c

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
medical/apexcare/services/fillings-restorations.html
Size 44KB
Sample260724-pl8dsaej8y
SHA256 82bbacfae93233ec16171600a82022eeb6b71227ca311f5fff5c967219d6f20c
MD5 172b1c38d21565457722555fce6e7f5d
SHA1 1dedfcd6c04cbd14fd4c6f9447f2e060a63746c9
SHA512 6691f21a31f7106de9d27c1908c045bc16cff86bcb1223b6565f9c08fbd6ee4d21167a9bdb07d0d66cf89e2d95aa2c33d26f91d6d9ed4c192ff839fdc60c4e3d
SSDEEP 768:31kr22KMvQhKfBDVXd3Rc7O0tj3HQXrOsOL3pd9bxkftrKJmmvi0I9wSkCu+8DLr:5jfb
TLSH
T10413752698D09023017386ED83F56A8CEBC681839F97590537FD1B839FF7D6AD99B408
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4800	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293697730207603"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{BF34474B-AB96-4F19-B0E4-9CFC34005544}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4652	4136	msedge.exe	89
PID 4136 wrote to memory of 4384	4136	msedge.exe	90
PID 4136 wrote to memory of 4800	4136	msedge.exe	91
PID 4136 wrote to memory of 4384	4136	msedge.exe	90
PID 4136 wrote to memory of 4384	4136	msedge.exe	90
PID 4136 wrote to memory of 1492	4136	msedge.exe	92
PID 4136 wrote to memory of 1492	4136	msedge.exe	92
PID 4136 wrote to memory of 2600	4136	msedge.exe	95
PID 4136 wrote to memory of 2620	4136	msedge.exe	94
PID 4136 wrote to memory of 2600	4136	msedge.exe	95
PID 4136 wrote to memory of 2600	4136	msedge.exe	95
PID 4136 wrote to memory of 2620	4136	msedge.exe	94
PID 4136 wrote to memory of 2620	4136	msedge.exe	94
PID 4136 wrote to memory of 4520	4136	msedge.exe	97
PID 4136 wrote to memory of 1768	4136	msedge.exe	96
PID 4136 wrote to memory of 4520	4136	msedge.exe	97
PID 4136 wrote to memory of 4520	4136	msedge.exe	97
PID 4136 wrote to memory of 1768	4136	msedge.exe	96
PID 4136 wrote to memory of 1768	4136	msedge.exe	96
PID 4136 wrote to memory of 6112	4136	msedge.exe	99
PID 4136 wrote to memory of 6112	4136	msedge.exe	99
PID 4136 wrote to memory of 6112	4136	msedge.exe	99
PID 4136 wrote to memory of 1612	4136	msedge.exe	100
PID 4136 wrote to memory of 1612	4136	msedge.exe	100
PID 4136 wrote to memory of 1612	4136	msedge.exe	100
PID 4136 wrote to memory of 3340	4136	msedge.exe	101
PID 4136 wrote to memory of 3340	4136	msedge.exe	101
PID 4136 wrote to memory of 2356	4136	msedge.exe	102
PID 4136 wrote to memory of 2356	4136	msedge.exe	102
PID 4136 wrote to memory of 2484	4136	msedge.exe	104
PID 4136 wrote to memory of 6120	4136	msedge.exe	108
PID 4136 wrote to memory of 556	4136	msedge.exe	109
PID 4136 wrote to memory of 2388	4136	msedge.exe	110
PID 4136 wrote to memory of 5620	4136	msedge.exe	111
PID 4136 wrote to memory of 5620	4136	msedge.exe	111
PID 4136 wrote to memory of 4896	4136	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\medical\apexcare\services\fillings-restorations.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffb6b04c188,0x7ffb6b04c194,0x7ffb6b04c1a0
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,5596133436740645748,7333987902612033380,262144 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,2251727844163366602,11064137679282189966,524288 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,12950310261920534375,15406578431308542339,524288 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:13
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,8207660478423074430,3657826034363798828,2097152 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,10265765081103919527,270814987565469632,2097152 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,2080830216493367857,11011134207722884390,2097152 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,6481325696251032812,515119204502169731,2097152 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3740,i,6546944772599642549,18110531684992108542,2097152 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5500,i,15710814092720519123,13213912036852695696,2097152 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,16338326974160817500,13842978428096195693,524288 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,695409454726909467,495715249874052980,524288 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,13344764942027179759,13172144913758227644,524288 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,13344764942027179759,13172144913758227644,524288 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,10705535469561657973,13806497562406135030,524288 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,4142259272954510930,14084029101204548274,524288 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:14
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,4460963735372251514,5638458976878008734,524288 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,3947555921824199575,6657524718481160169,524288 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4892,i,441602760176826246,18369960680339798893,262144 --field-trial-handle=2500,i,5992409940911647054,16805798970077423033,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 256d96bf9d4afc5639d93fc5e0b78e4f984fe115720adebd90e4719a662782f4
MD5 319617dd2c5bb565f2ab5061dfe9ab93
SHA1 0b45e31285c08ab21ad93641bb453fb2fb094040
SHA512 518668fb530c8ff76180e6715ea18de4879be39aa248c64af0c93dd311591c9bf70fec599ab581d0fb539c62d68109ae7e69b75de0b256c5ed341960f87a389f
TLSH
T180517561536209C2E7BE0EB2F7E1544B7EF5A4DA0A4BBE03C0D06E7488E6F041DD90A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592dec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592dec.TMP
Size 2KB
SHA256 08f2417471236208d3fc7dfb6c853a206656910710d09c679acd21390772de60
MD5 dbb342115ccc03ab0d7a062c540537f4
SHA1 ed5320a04fd776370ef3d604a1ebabc9491a7dbd
SHA512 95c6ae7da2864cca3c79cda6be37d2f5e90760a2a16081be456f49a0a236ceedddd5bf921e1b8112e559e6502edfdf7df79f1af47a1e67206758910547138844
TLSH
T12B517561536209C2E7BE0EB2F7E1544B7EF5A4DA0A4BBE03C0D06E7588E6F051DD90A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6bb67bc3b46038ec9a4c3253a112b1fc2199218eb31699c13b7ed85a505bf2dc
MD5 08600b3f6b2c86b558f5ff6c97f7e278
SHA1 2dafeaaf551c02010f37f616b30f5015c3bb06f3
SHA512 a79f0b0b6e1ea699a3ae400b6a174a092c6ab2e12eeb9ba7783e87c64565fdd3f940b9a09987a2cb5eee683fae28646ac96ab3dba52de02872c99ef46659b19a
TLSH
T178817BB7C3E8876E881156F0AB247E2ACE1D055A826C3C668DF4AF5F63E2471D10169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b391fc52975e787898941b4ed933e2184a605e0eb8350227292d267f12c70103
MD5 b2985386dd2faef6de4d3f714f0fef86
SHA1 c9c242cae3e1ec6b48279bace569b828f8f19000
SHA512 451ac37f4ed9aafaa61ef7399df734129b2bb63ba81ca3a92137915047623625ac66607041e59768d99ec70bdefca9ce09347786a9561d6a42250ff227f00a48
SSDEEP 192:sxRoRMbI/fW+sux3prQ5mzoA8p4D/g6+WNIYn8ehNG4yIgDQJ:sxRoUI/f9sA3Ua/5ITksg
TLSH
T1ED3295166A68A93B5CCBE219FB55BF53D2F95073A1D02E48A6FC8B0C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5c3fa2993e85f0061e78849466ea8cc3e64c86b6d2a947ec3afe921e93feea96
MD5 23c8bca598f07169995c8d365473ceea
SHA1 6d410e499b5646a4d279f7a4c054900ebe53564f
SHA512 724aa587cfec45467245c718ec667e06a5406d4f1062038aa82bcd715018e570a4079e4e663ef35011719d7d14aea6ba5d55fa5879f8bc9c2b857c9289ff7ccd
SSDEEP 192:sxRnRMbI/fW+sNxgprQ5mzoA8p4D/g6+WNIYn83hNG4yIgIJ:sxRnUI/f9sbgUa/5ITRss
TLSH
T1403285166A68A93B4CCBD21DFB55BF53D6F95032A1D42E48A6FC9A0C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 116f3389b992b104e736ae8ea139dab4a96a356d8e5f681ce392c4fa4d185617
MD5 d90dc7b4748438ca136acfb40a08e820
SHA1 75af4f77dea6997a22da759d06757929d0e7fa0c
SHA512 f88b87e2a0a6d0711d87e41d6db3db488a6241031dad3cced7cf72ee9cc58ab897c7808e6d4cafe7fa7f433abe3342ccd7ff98b62c941d72a19fe36203aa8ff0
SSDEEP 192:sxRoRMbI/fW+suxgprQ5mzoA8p4D/g6+WNIYn83hNG4yIgDqJ:sxRoUI/f9sAgUa/5ITRsy
TLSH
T15E3295166A68A93B4CCBD21DFB55BF53D6F95072A1D42E48A6FC8B0C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 cfeac29551fa62b8e78176eb1485cb0cf370b9a579724680c800564ecf051f9f
MD5 79aa57f013b02b95a4cccd79e2ee3c7f
SHA1 82dcc27cb1ed3e20b10a54da396905197b9e89ae
SHA512 384fb5d89c6d017a5d180cdd1cd0f981c6e2d74018dec8c288cc338da8a9ef2e1a10048100770f1f199ad5205b751d87e9d17e79f8d67e4fe4d3483617772f37
SSDEEP 384:wum8dzAfCtgoSFfmMKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPcroh59:wb8dz6WgoufmM8F1+UoAYDCx9Tuqh0VA
TLSH
T170B2DB3B604DCB7E5F800AADDC19AFDB6D9802C79A988D4447FE990C03C77EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 06b30d25b0f6259d7f8d4c2cb3394e4fb830692fc6e14eeed7b54b379d8a4fba
MD5 efcf75fcb467f861720f1d4e577bef76
SHA1 1b5015a136e1b303b10ebceaa276ec5da9f38a64
SHA512 dc73cc1bcddb3dca45075f690c837d9684246727fbe505d5f9840676c8aa17b3a6908aefd11ff000d91c446785c4fe805087edde418d7b4c6a5e62639c029e4e
SSDEEP 768:arv+4UNbd23vRXLUtDZIO0BaK4Nzc4ReyIsPkb9M2:absbw3vRXYUaBtc44bssb+2
TLSH
T1CC13CE32F9298A73ACF69656F04B39433EF8515BC2C81A94D6DE6F4C0A4B4ED431B423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6de4737dd27f9810a8789d6f498bb310e6f8bb65f1a6c628a2869c2a32b424a1
MD5 61ca834d19f4f57ea68db6ccd0061f16
SHA1 fd191bdadd4170291ef8f579ee61986869308879
SHA512 f04914c7edf48302c9295812750ba13c1e8192e06e248b2f67c3aa91167fb775f443c2ff448da46ec8a2b7e9819975ca6cad2b3691161fd62a1b246213c4f202
SSDEEP 768:vrv+4UNbd23ORXqUtDZIO0BaKxNzc4ReyIsPkb9M2:vbsbw3ORX9Uaatc44bssb+2
TLSH
T13613BE32F9298A73ACF69656F44B39437EF8515BC2C81A94D6DE6F4C0A4B4ED031B423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 3e73e75a2ab5aeaf63c57d26a6e5579d0689faa06ea5b28be86d949b1a4e79ef
MD5 6748a7b0783e8bdc5927604cfcc5edf3
SHA1 83062ad8d1947925d7f3cf1e8e4205e0b8579206
SHA512 8997da0f80b956cda7c45322c54698c48eb3fa6182a0f3f8165cd4400c588c04d44be2b21a78ba9349c357a0963f775cb27e52d3f9c95f8dc14c97256a158e93
SSDEEP 768:MF0rv+4UNbd/3zwgKRXqUtDZIO0BaKRNzc4ReyIsPkb9M2:Jbsbt3ERX9Ua+tc44bssb+2
TLSH
T17F13BF33A928CA77ECFA9A55F54B35037EF4506BC2D86A94E6DE5F4C064B0ED030B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fb78b6c7794bc6af29b1ad59758f1725a564949aa15c4f6496eaa8b9cd91b857
MD5 871f725e3eb6b9f512367d19e5f9a5b0
SHA1 69215ef06b42d143b7e54a8446cad96896671f6a
SHA512 04de7e32ec1b7a991665f81f34b6f1d34598e560578339b0d737237a6f9c1bdb86003d8bc4ab44b617304f74c0b47d57ab27c09e8605650eaffefab9e8a6d828
SSDEEP 768:6rv+4UNbds3GMTDZIO0BaHNzc4ReyIsXfeVH1S5D:6bsbS3dWaHtc44bsvEH1Y
TLSH
T13403CF32A8788977ACF6A686B54B76133EF89127C2D81E94C5DE1F4C464B1ED130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73e85792-770e-4b61-9cae-0a1c5bfc3d95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\73e85792-770e-4b61-9cae-0a1c5bfc3d95.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download