225f2b891c66edda6fee70d7919564e1b9c6335328c4d07d93c53100d531eaec

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bootsexec64.html
Size 4KB
Sample260727-w7hhtabr21
SHA256 225f2b891c66edda6fee70d7919564e1b9c6335328c4d07d93c53100d531eaec
MD5 f1b0b39a003ee31120dc6bbdbad3c7fa
SHA1 88bab5177576553132d3f34f374064dc345d0dc7
SHA512 b2aa29e90edaf68d3dcdbcead499eb2586106ec1cc88f250bd9e1d0ee37deb84fd99131d1d1630557f7b0cf06cd931b729424fc25e0b489e75a8bb7a50c9be83
SSDEEP 96:fjFj7jOjEUDK/D5DMFLzLeiO/tjGnY5av9eZNeBu77RslvaQxvbzM:fjFj7jOjEIK/VoPnOVAYEeZyu77qlCek
TLSH
T151B18272FABD107E1093817361BDB70A3AA1C043DA9A08903ABCC2755F8EF45AA172C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2736	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296509270338847"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{E77E489D-8BEF-4171-BF14-C634B7DFE5BC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 2616	896	msedge.exe	84
PID 896 wrote to memory of 2736	896	msedge.exe	85
PID 896 wrote to memory of 1452	896	msedge.exe	86
PID 896 wrote to memory of 1452	896	msedge.exe	86
PID 896 wrote to memory of 1452	896	msedge.exe	86
PID 896 wrote to memory of 4536	896	msedge.exe	87
PID 896 wrote to memory of 4536	896	msedge.exe	87
PID 896 wrote to memory of 2016	896	msedge.exe	89
PID 896 wrote to memory of 2016	896	msedge.exe	89
PID 896 wrote to memory of 2016	896	msedge.exe	89
PID 896 wrote to memory of 1784	896	msedge.exe	90
PID 896 wrote to memory of 1784	896	msedge.exe	90
PID 896 wrote to memory of 1784	896	msedge.exe	90
PID 896 wrote to memory of 4136	896	msedge.exe	91
PID 896 wrote to memory of 4136	896	msedge.exe	91
PID 896 wrote to memory of 4136	896	msedge.exe	91
PID 896 wrote to memory of 2040	896	msedge.exe	92
PID 896 wrote to memory of 2040	896	msedge.exe	92
PID 896 wrote to memory of 2040	896	msedge.exe	92
PID 896 wrote to memory of 3668	896	msedge.exe	96
PID 896 wrote to memory of 3668	896	msedge.exe	96
PID 896 wrote to memory of 3668	896	msedge.exe	96
PID 896 wrote to memory of 3356	896	msedge.exe	97
PID 896 wrote to memory of 3356	896	msedge.exe	97
PID 896 wrote to memory of 3356	896	msedge.exe	97
PID 896 wrote to memory of 2348	896	msedge.exe	98
PID 896 wrote to memory of 3936	896	msedge.exe	99
PID 896 wrote to memory of 2348	896	msedge.exe	98
PID 896 wrote to memory of 3936	896	msedge.exe	99
PID 896 wrote to memory of 3372	896	msedge.exe	101
PID 896 wrote to memory of 640	896	msedge.exe	108
PID 896 wrote to memory of 4876	896	msedge.exe	109
PID 896 wrote to memory of 1100	896	msedge.exe	110
PID 896 wrote to memory of 460	896	msedge.exe	113
PID 896 wrote to memory of 460	896	msedge.exe	113
PID 896 wrote to memory of 1560	896	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Bootsexec64.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff8bba5c188,0x7ff8bba5c194,0x7ff8bba5c1a0
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,18122023039864613599,18201561520263528498,524288 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,3127299080234570396,15861426668157827922,262144 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,8995417874464651546,16828394025131838294,524288 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,9740662999219847670,15897442631388078577,2097152 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,14269454619482523560,8348644649335162957,2097152 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,13388143801406928464,9899300383323242669,2097152 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,4894640651017574032,7018794469778973738,2097152 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5088,i,6533111504935054183,1773684820735978657,2097152 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5284,i,1704804714861885836,3217885489532035937,2097152 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,12181363496800859109,3806783059348719640,524288 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,9592870721920259222,2333189001602462559,524288 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,13454026249436683951,14659810705101397978,524288 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,13454026249436683951,14659810705101397978,524288 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,10033507726293402860,7117947214949807836,524288 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,3037847893177602074,13493991787909172342,524288 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,6244386954528231335,1115610052400900284,524288 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,9899825001628088970,12928868380174122924,524288 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6440,i,18148547124834172960,1066026687892910133,262144 --field-trial-handle=2232,i,1455155822895490158,6064029174782973848,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

4ba1919b-e416-4f84-9107-18c029f4f728.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ba1919b-e416-4f84-9107-18c029f4f728.tmp
Size 30KB
SHA256 7d6d1e8538cd8265ee5dc7ff065bb63d344c2d2a7a1c3bd03ec6296973a38150
MD5 a6aa30fdd12cac672480cf2cccc62f22
SHA1 85330b4aa68061c9d71ff29f707de9536f3faaef
SHA512 54bffa2e21ddf9335fda158301c65b70d9ba5a0b3ec16abef50c6d8c66c969f18e4b9441fb3380559154ae7dcb47ac1d2c293e4949d94a4c79aedac6dc66d3e6
SSDEEP 768:mtUZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RNroVA0f:mtUZYTMWvg09ou1ja7eLZmRm1f
TLSH
T18CE20A2F680CCB7E4F844E9DEC2AAF963ED801CB5A584D544BEA894C02C73EB511759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a32c8eb7159d8c4e900b8e945f98fe9d5c52dcfb47dc7e0be2845e5d31e028e0
MD5 a9ad3c8ce31fb8efff34650bbf05ea08
SHA1 eac8c4f2a8c90d72be83f381e9a1398ae85360b6
SHA512 2dc09224e1168cd20d577665fad6e9219638b82e2d5aac43b0cabe3b0440463fd0e2f7d343fdc91858b8d8ac925961a48c825907f9fea70fdff550cf8a5fb657
TLSH
T1B161B468CE524B95E7A00333DCE21A9435B188D40E2F8E5111BCAFFD6914B68FD76409
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2e1923b8dce166b621d47fdd880810567e24c73063c5635353824e4ade2782b6
MD5 5afc57122b5340ffae0d6046fbd3d164
SHA1 fa16fa028c58c963291ae4efa625fb31ddcc9cf8
SHA512 a3bfaa155e08a72f99a3ddfcd87cb9c7bde2dd655d591bb3cc42027149f6e65d1054e1ac99bae663622456e50ae8147966ca9ee57537d342138bb4bffd2fca47
TLSH
T132318EF7C3E987AE885153F05A24AE2ADD1D050A42283C268AE5EF0F57F2171D10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 85aa3275a0c1c20c78a2d6996cb919b8d5e2c6c84dbdaad7fbe1783d89b1c758
MD5 d57756011ec8b51bebab8358186eb416
SHA1 17df09f7ffc679400eabfbd2a6d5f88e63e62d1f
SHA512 e3aecba38299e30d8d6c6872acb9d8589e0b5f637aaee25fe5edadf7f8782ba351fa2b3b1761752731f1c1e659001e6ae8da63065eeae48aa8d26c2fbd80ca5a
SSDEEP 192:sxZ9R9yM/jK1Ml8Mkx/f/smo1DM0IdpdWHW6+WNGYHjSWoIgrJ:sxZ9rMx/f/s/atoHbGH9
TLSH
T10442E8166A34AA77CCDBD209FA557F53D6F51572E2900E44A9FCCA0C04E6AED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 af820ca6a4c5b383d1dd85026d2f78273b0bfb27b8376673828a9ec56d3693a0
MD5 bf176344910e8338279d582f8af48158
SHA1 92070ae8abc18fc9ef6a4c33144dcbf1dddf98db
SHA512 c1f716661e3158c74a82e94a24ab64bf12b0e69513f5017e2291aad6206b800a345836242b6bb7fcf6880898d8b5b1ed5b7174694ddfe79dd274c8f58da30cb1
SSDEEP 192:sxZ9R9yM/jK1Ml8UQUkx/f/suo1Di0IdpHWHW6+WNGYH3t1IoIg5MJ:sxZ9rqvx/f/sH8t2HbGwZW
TLSH
T19152D7166A349A77CCDBD20DF955BF53D6F51572E2900E44A9FCCA0C08E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 f9d97de4026e9b4d5bfbacdabc713891e6917076558de28c28f7fc802c04de81
MD5 bdd63a45c72106078fa42fe156f521e9
SHA1 f9e7a9f50ce757161ab947968f039253a2c0578c
SHA512 4246bde86e3f32c4c4f2b34a012f51e9334b494782199764e19e31faf3e9617b976da3d65bda94959d0d24971fe35285f59dc1972cde75cbbc05da5cf6d940ca
SSDEEP 96:KA1eK2AseUKXqlmd+KuARvmK0UyiQAKliT7ahF7q:EWE1r9nI7ahF7q
TLSH
T113D1E31671BA13113C7D2A0C86B59B668E41B563702DA52B7FED00B54E2AE209FFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59361a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59361a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 969a62ae3020e8ac45031b5d0b7e29ce4ee24f1d3201c3f948af899f821741be
MD5 9078c0ff043f5b0fda15e559f9581eb9
SHA1 30cd521993a94cc69a6d6d9e7c1584eb2504474b
SHA512 6fab5590548d1755402b6923745b50fcda6eb44aec6f55b07b990e66acd0015469bba5561ba95432c0f9dddc78b5b55c3372330d48e065bdcb543a25139d343b
SSDEEP 384:0ZcIhsNI7HyFbuzX5od+2d6/Id+2CLLC9OObjI9G6w7jm:yhAmOv3lCLLC29MS
TLSH
T18C928D32A8385D378AE7A551F8CB35135FF8A177DBD82B84D1EDEB0C09969BC130A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 bf2f09082eb55c5e7049e06c285712eae15edb62bb81bbf797aff48935f89e0a
MD5 ee7ff99b0339f0e975c53cc89e29d92b
SHA1 5c83ee28ad31b792f5d49562c1f2307b48d0b0e9
SHA512 c2e9235e6251e905b1161a0f3b6278922e3d88ec51e7b686c207485086ac85c4e4f75f153dbab2a1250df4ff9b8ae89552579eb65bf221448139b7110ba69b4d
SSDEEP 384:BiFiZcIBzsN48TUNTUlIlqHyFbuzX5od+2d6/Id+2CLJC9OObjI9G6w7jm:oFQxpwg5mOv3lCLJC29MS
TLSH
T14AA27D339868893BDEE6AA55F88B35134FF45177CB98AB84E2DCDB0C05975EC030AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 920385206fcac62fbf49f8580efe8f72b52b95d8997eb72fe4064e9aa7f8f6dc
MD5 eb45df1436597c4674f43932ff505f72
SHA1 97a0b3e39cf6dcebbc38a8621298bb99deab74bb
SHA512 c9e6b1cc137b0a3984f0aecde5757bb4678eb6a9746e2aae17cff7e7f0126745c73219349575df371b0166f9a46ee0cac71ac77717dbec441c9a97214cffc70a
SSDEEP 192:yONI61VWQmiUyVVV4gGX5Obd+j1+FdgX/t/aG3PXU6:yONI6WDgGX5od+2d6/w+XU6
TLSH
T14A02C63568686C6BCEF2BD49B48777135FE4216BEA952B84DAEC1B1C009769C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 28da511424a46c2fcbbaf3e9126c54a6d567c4a2b62f3ceb2154f7cf64e275bf
MD5 6cded7e5212182dd089d157f9f693ad1
SHA1 d279033bf445bb140637b58376b71cc61a40e127
SHA512 dd19666532a9b1886c34048fc84df07e6d4efc742c8f17142feb928d19eeeeeb58edfcc177e33e6526c9efde9265ffc1c0fb1ced9ce8808154d8d30d4f0de354
SSDEEP 192:1ONZ61bWQmiUyVuV4OGX5Obd+j1+FdgX/oxFd+2CLkjJZQq69U6:1ONZ6ICOGX5od+2d6/Id+2CLcC9U6
TLSH
T165120932A4686C278EE2B955F48735135FE45267EF897F80D5EC2B1C01DB6AC234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e97496c8963f4417065559c5b0ef8e22bb43d92a9a38c89a107e1bf69276930c
MD5 af73e5acd1a624d536f9e623f7f127f8
SHA1 daf1e123c86780f2429b2a17e4b145e7ac8c15ea
SHA512 46927d75b5408d947ad67d03091bad478106070b48c401eef1614cb7e257d0932eb76f53e86960a91efc60dc03d114ad99159877db7362e3fc5f30dd63088524
SSDEEP 384:hZcIhsNIqHyFbuzX5od+2d6/Id+2CLLC9OObjI9G6w7jm:phXmOv3lCLLC29MS
TLSH
T1F1928D32A8385D378AE7A555F8CB35135FF4A177DBD82F84A1ECEB0C09969BC130A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ad4932e-9b97-4c75-92a6-bd6c17b68790.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3ad4932e-9b97-4c75-92a6-bd6c17b68790.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c92eb29d69600ee6367c2018020f3a61ab6d219cf5ebe8e1c9e04e5bda2a051c
MD5 204574ff19f77213488998aa34e92f46
SHA1 9c27ae68ead13e91f960447aeea6765f5e4e7223
SHA512 5a468ab1033c43d86f1d2aa120a87e32b069b974aea61714a35ee66fd8ce39c4304b9ec2c8669b4270b91b83ae8576d374e4b22b3d06806692616f9fd6ef57d0
TLSH
T1FE410948A6FE1158B3B76F4AABF668AE487BB9371E4BD49E10110D4E0962F40CC71733
MD5 SHA1 SHA512 TLSH

Submit Download