f256c009cf2c12f303fd0b7d35acefdc50b7e459ae56416742e3492a69142ff0

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
medical/apexcare/contact.html
Size 26KB
Sample260724-pl8dsaej8y
SHA256 f256c009cf2c12f303fd0b7d35acefdc50b7e459ae56416742e3492a69142ff0
MD5 a63192e4e2bf530b5977245981517fd8
SHA1 5945e9deb14cc0c3b8aac4b8cda98f262cbb0817
SHA512 c3bd741179969c66da8efec6ef72a06ac79d51e0e2ef4d807c6ceaa722788a141a3288afd78db665b863d6544f7e7190ba62f7c8fc8d4143842c5667be01ec15
SSDEEP 768:3+2SXQlYkhoqr2xe8T/dzag9wSkCu+8DL2IKEl:f4YHz
TLSH
T137C2FF62B8C48027127386E6E2A5B75DFEC29283DE4B964871FC53831FB7D63AC53458
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1584	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293697938756421"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{1391451E-3049-46C1-8877-A9F56B8A2E77}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 1860	4968	msedge.exe	89
PID 4968 wrote to memory of 2896	4968	msedge.exe	90
PID 4968 wrote to memory of 1584	4968	msedge.exe	91
PID 4968 wrote to memory of 2896	4968	msedge.exe	90
PID 4968 wrote to memory of 2896	4968	msedge.exe	90
PID 4968 wrote to memory of 6008	4968	msedge.exe	92
PID 4968 wrote to memory of 6008	4968	msedge.exe	92
PID 4968 wrote to memory of 4552	4968	msedge.exe	93
PID 4968 wrote to memory of 5264	4968	msedge.exe	94
PID 4968 wrote to memory of 5264	4968	msedge.exe	94
PID 4968 wrote to memory of 5264	4968	msedge.exe	94
PID 4968 wrote to memory of 4552	4968	msedge.exe	93
PID 4968 wrote to memory of 4552	4968	msedge.exe	93
PID 4968 wrote to memory of 1436	4968	msedge.exe	96
PID 4968 wrote to memory of 1436	4968	msedge.exe	96
PID 4968 wrote to memory of 1436	4968	msedge.exe	96
PID 4968 wrote to memory of 4636	4968	msedge.exe	97
PID 4968 wrote to memory of 4636	4968	msedge.exe	97
PID 4968 wrote to memory of 4636	4968	msedge.exe	97
PID 4968 wrote to memory of 1240	4968	msedge.exe	99
PID 4968 wrote to memory of 1240	4968	msedge.exe	99
PID 4968 wrote to memory of 1240	4968	msedge.exe	99
PID 4968 wrote to memory of 964	4968	msedge.exe	100
PID 4968 wrote to memory of 964	4968	msedge.exe	100
PID 4968 wrote to memory of 964	4968	msedge.exe	100
PID 4968 wrote to memory of 2340	4968	msedge.exe	101
PID 4968 wrote to memory of 564	4968	msedge.exe	102
PID 4968 wrote to memory of 2340	4968	msedge.exe	101
PID 4968 wrote to memory of 564	4968	msedge.exe	102
PID 4968 wrote to memory of 2980	4968	msedge.exe	104
PID 4968 wrote to memory of 2940	4968	msedge.exe	108
PID 4968 wrote to memory of 2476	4968	msedge.exe	109
PID 4968 wrote to memory of 1480	4968	msedge.exe	110
PID 4968 wrote to memory of 2768	4968	msedge.exe	111
PID 4968 wrote to memory of 2768	4968	msedge.exe	111
PID 4968 wrote to memory of 4692	4968	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\medical\apexcare\contact.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffe61eec188,0x7ffe61eec194,0x7ffe61eec1a0
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,5310956118457380352,16696623429422707296,262144 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,776016294157553681,10142848356034947313,524288 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,1031413494001265048,6230231888198683536,524288 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:13
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,6132120280024698112,888110904519410116,2097152 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,5401941769558749260,13673015985682462491,2097152 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,17781689891377220082,9933099040091143096,2097152 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,11336181743761899568,566806060137480460,2097152 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5352,i,14393579439395507041,1356460808278070347,2097152 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5508,i,8084550690133152550,17445161134347791298,2097152 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,974059602362892676,3686572922735339784,524288 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,7133549989201068374,15363081125093479854,524288 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,3839425925193823494,3832157736367933648,524288 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,3839425925193823494,3832157736367933648,524288 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,16724261247712127332,15186797623082582510,524288 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,947555953431378426,18121373322829676055,524288 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,9744482311803155261,5092364525387953636,524288 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,14209435178904863112,4873674329451393045,524288 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2080,i,10388186362092533254,12957729182985029546,262144 --field-trial-handle=2292,i,17672483397610345508,5182257766466948100,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2986829f64a9281e85275dff0283c018330c77ef5c35950196c532d7fc6f531d
MD5 42a87f63bf1d9d0ae918693c4abe9f83
SHA1 be140bbb557036be841ebc6dbb4b0688b85d90a8
SHA512 3c6008dad42efc4476f9a67f5d23fac241b4aee96cb95174e8b78995bc8a800df2ae63e1910919dc102f991702021aed6313154bf7af94778a8207dca6451f69
TLSH
T1294143BC23AD28CAD7A6ACF324F74598B2F1A60A650F7F42C9692DB9CDD5F1410C0153
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598fd2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598fd2.TMP
Size 1KB
SHA256 cdbdf1e24f12691bd7281530f8ca1751806efae4c46ca7643dbec20465504827
MD5 1f068d32fe14b654b07512fe978657e6
SHA1 f1c651559ec2412912784a5a9f1967841520b447
SHA512 9be90df4d419ff3b969cde667ef2ab2b82e30d6e799d89d5f3f94432fd2b3029074003c15d51488190017bde9b0c62437494eec1341efa45fe3cd3a50a81725c
TLSH
T1FE4163BC23AD28CAD762ACF324F74588B2F0A64A650F7F02C9692DB9CCD6F1410C0013
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 916bea7fc31b32db2cbad13650e3be970672eb0eddf4442393157fa454095028
MD5 48e6a97b5654672aba7b229e01c86cc1
SHA1 8d009b4a84ef5c7dbfbb272f3d6302531c04b62b
SHA512 f7dac45de04bcabaabab1b7a7ed8306846a7861d36b86c14b8b84c1523f40c83159831b303df20613fe0e520c088c41c3c44e0ad23fa030e6d77940eb585191a
SSDEEP 48:YALlglNlOg5Pg0hSjsJzaAsJ31foKsJrfgmgCZsJ3fjhhnONzsD9zsqrzBO8sz1W:DKTOO3fa91WiNjh9TzBOlsnrpZ3w6t
TLSH
T1F9918DB7C7E8877E881156F0AB157E2ACD1D051A42283C6689F4EF0F67E2471D24169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4bc0927a071fdc55bad474a0fd1bce8bf0311cfb9e4664befbd065ac12a0ffb6
MD5 ac8dd6d567cd7f86a0f1efefb0a98af0
SHA1 52fbc4080b1817a47d1900771b960be04dd05bcb
SHA512 9c54ad2e2665d5dd88c4b8d5958a99e4f302ec620e03a64a97ec1d89adb468c8eedd70226885cf5335a7eb2fdda68a6a7940cc632a49542b25ff5bfda13d1bd4
SSDEEP 192:sxRKRbbu/fcsqATDde5lSwzoD8p4r/g6+WNIYC1UOvG0IgDjbJ:sxRKtu/fcsqATc5lna/5IPNF
TLSH
T1CA42A61A6A28997B8CCBE20DFB55BF53D2F95033A1902E48B6FC860C15EA6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6e4b45c5a7006b02a5c306bae7d54c60cc2538b98c4b2dc9247d8b0a43c08f57
MD5 6a952bfbe4a97c9d0386f6ce9e673e37
SHA1 35b04d5fd76879355e3bed767df4ea7a3fcf9c45
SHA512 d97bdb97f52cb94e0edd9c6b55505947b5c013cb61733df2031ec5424221b4c686e344d48096def389eb084d96b1af57bb7408799993504f24c0be3b9031e997
SSDEEP 192:sxRRRbbu/fcsRAWDde5lSwzoD8p4r/g6+WNIYCyUOvG0IgIJ:sxRRtu/fcsRAWc5lna/5IYNs
TLSH
T1C232A6166A28993B8CCBE20DFB55BF53D6F95033A1D02E48B6FC960C14EA6DD120750F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 915aa99180a3fe70c205bde68645cf27fd992a055dd3e9c6ced08082d83c1bc8
MD5 26aa3425f6a8805a357d1680a98c1a7b
SHA1 c1e2752241375490b084f7046bdbea7040c222eb
SHA512 90c66e254443e7f37eb51e939131d04234657261717de4cacdbf49e7f8f30838bac71936533010ce57fe0e66d25f4e412283482105c4582fe06617a3feabd836
SSDEEP 192:sxRKRbbu/fcsqAWDde5lSwzoD8p4r/g6+WNIYCyUOvG0IgDjVJ:sxRKtu/fcsqAWc5lna/5IYNH
TLSH
T17342A61A6A28993B8CCBD21DFB55BF53D6F95033A1902E48B6FC960C14EA6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 81b1816fd0666cd18961fe4d862a0f6a13478ae60421c38e6dcfd57a651fa073
MD5 60a0ec1e747ea059a30c32dd44058b50
SHA1 b8fc66f9dd2833faa7be5d3b0793bacd003a54e0
SHA512 106d49125d6bea7dff5deaf42d32ee76e761806b02c000ab2ea903744ae95c3ff676f5005d1a62d981afceb270c9f5ce401eddd593840655441bc1ab9078f25b
SSDEEP 384:jjm+vhKfCtgQCFfk+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvfroZSA:jC+vhQWgQ+fk+8F1+UoAYDCx9Tuqh0VL
TLSH
T1C8B2DA6B600DCB7E4F800AADAC197FD76DA802CB97589D4047FED94C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a41b5d944569b8528d06c406f87e627024aa092ef578d81ed9711d264341f22c
MD5 4c979224e303da2fd9f86d195cf94042
SHA1 9aeab9fb0a32ea850ee9df7a0dfbd93a9583d5df
SHA512 dbc3d8ebf4ff661ef13a3ba92c494d49b5689b65181be77b354628af8123467c72357eb314c6462c752fbeaf62fe30b071a206154c4e1f180477bcabd10e98fc
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHLURlTp5FWtC4gNFK40gjFcrz8fnAHRu/C:CbEBVj5JAdSp9/EgTK7j6dJOHLURlTpw
TLSH
T1F8912540313A1241383DB50C81B98C2A96C1B472746EA5AF3BA941B61F2BE43ADFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6cd381820b2a2bcadff2efd3367df3f293f0c5098456473e398f4a825ecd9528
MD5 479e9cafc2da70b6b8b0d05461cc53ca
SHA1 838607ace49ee42095bdd97e95bf0e191c5e2f4c
SHA512 c034bb72c58643130377e781d04c111056202d8d08d9520c818ce1c611043a58cf7298238b1f59975645f11a5f860997ddfcaf784a1ae39c4f2ea0e41f5caec3
SSDEEP 768:Nrv+4UNbdI3SEdkLHp8+p3bd66j+4BRv86aLIWPRsp:Nbsb+3oJ8+p3Z6n4ytap
TLSH
T18D03AE72E8A8D9739CF6C644B1477A437FF8509396C00E94E9DD6B4D429E0AE230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0cca5f34ba6bb88f52cb6dba547bc39cf4e81ac320b82eba20ef5b3c50a9e03f
MD5 26e043f23f67bc0a0c46ddcd131717ca
SHA1 0d9279109936908f019eac2a8c40f865f9a7fd80
SHA512 6f1e1c1e348e53c0fb95f75c63f201332b17d06e427b069896cc0a2c6748514e4c1c2dc73c27b1b07a671372df0ee788400852215a27ec9e6fe8804c4079c715
SSDEEP 768:/j31rdkLHp8+p3bd66j+4BRv86aLIWPb9MK:/j3cJ8+p3Z6n4ytb+K
TLSH
T12EF2AE72ECA99D739CF5C744B1863A436EF451A3D7C40E84E4EDBB0D059B06E470B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 1a0f0e2863d37b87e4a36128f973e761f2bd8f58223f5accde3733656f8e30ab
MD5 add5377c7e448d667cc6ff9719538411
SHA1 4f289e6a20dc831c4ba88d07671a8310f5293610
SHA512 d89541d6d9c077fd58ec3ffe90f82a233a3c91747f946c68815799882792ab1b1336b94ba80623f3531f08614166baa232eb486ab70f32cc89f3a89c8a6e4ad2
SSDEEP 768:oFQ03ewgWrdkAp8+p3bd66j+4BRv86aLIWPb9MK:L03T8+p3Z6n4ytb+K
TLSH
T1B603AD73EC98CA779CFACB44F6863643AEF450A3C6D45A94E5DDAF0D01570AD430B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b5e81d1a7362e2cf785d5c14954ac775bb35982a45595df3e0a803d9558a8854
MD5 ebbc414b855c470bc18cdd22ce6c7de5
SHA1 bf80c467f7158c44404925aaf0adf971262ad5a1
SHA512 5fa4c77f8183152440c2ab51ea4b2e34b1ab43fd387d8831d4266fb8d7e7dd074bffd23ecfa32eb335d92f89dc0bb9427e28d44a0990f2f17c2dd74e5141f5a0
SSDEEP 768:jj3SrdkLHp8+p3bd66j+4BRv86aLIWPb9MK:jj3jJ8+p3Z6n4ytb+K
TLSH
T150F2BE72ECA99D739CF5C744B1863A436EF451A3D7C41E84E4EDBB0D059B0AE470B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 34c388c2d198863662d0022c8036e010e9b2b119f74b1e713398ab6d71f0d184
MD5 3f5f1a52be9eedbde78d77863e7b63a3
SHA1 28d56f9b523d82536f49877533a4d1feae82b3d0
SHA512 8abbb093fbb55bac2f6269d051a0c3c4f72efc776083292988f76201b8ca0716a1d6f3d4eca4b6c79dcf35bdbcb3701e7b284085df1b59cadd2a5cf918b9d8b4
SSDEEP 768:Irv+4UNbdD3scnNp8+p3bd66j+4BRv86aLIio2bwCl1:Ibsbp3bL8+p3Z6n4yO0ww
TLSH
T1DD03CE73F9A899339CF6C644B2467A437FF851A396C00AC4D5DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40de119b-31ef-4b78-9527-271950a1f44e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\40de119b-31ef-4b78-9527-271950a1f44e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download