hxxp://d9lglgm071bc73ehl24g[.]join-for-preview[.]com/3aesvr2l9y/

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://d9lglgm071bc73ehl24g.join-for-preview.com/3aesvr2l9y/
Sample260730-p5ldcsstew

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298896952805449"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{605DB961-C16D-42C8-8571-4AFBE79005DA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 3848	4452	msedge.exe	85
PID 4452 wrote to memory of 4988	4452	msedge.exe	87
PID 4452 wrote to memory of 4332	4452	msedge.exe	88
PID 4452 wrote to memory of 4332	4452	msedge.exe	88
PID 4452 wrote to memory of 4332	4452	msedge.exe	88
PID 4452 wrote to memory of 4484	4452	msedge.exe	89
PID 4452 wrote to memory of 4484	4452	msedge.exe	89
PID 4452 wrote to memory of 4248	4452	msedge.exe	90
PID 4452 wrote to memory of 4560	4452	msedge.exe	91
PID 4452 wrote to memory of 4248	4452	msedge.exe	90
PID 4452 wrote to memory of 4248	4452	msedge.exe	90
PID 4452 wrote to memory of 4560	4452	msedge.exe	91
PID 4452 wrote to memory of 4560	4452	msedge.exe	91
PID 4452 wrote to memory of 5116	4452	msedge.exe	92
PID 4452 wrote to memory of 5116	4452	msedge.exe	92
PID 4452 wrote to memory of 5116	4452	msedge.exe	92
PID 4452 wrote to memory of 652	4452	msedge.exe	93
PID 4452 wrote to memory of 652	4452	msedge.exe	93
PID 4452 wrote to memory of 652	4452	msedge.exe	93
PID 4452 wrote to memory of 3836	4452	msedge.exe	97
PID 4452 wrote to memory of 1588	4452	msedge.exe	98
PID 4452 wrote to memory of 3836	4452	msedge.exe	97
PID 4452 wrote to memory of 3836	4452	msedge.exe	97
PID 4452 wrote to memory of 1588	4452	msedge.exe	98
PID 4452 wrote to memory of 1588	4452	msedge.exe	98
PID 4452 wrote to memory of 3284	4452	msedge.exe	100
PID 4452 wrote to memory of 3168	4452	msedge.exe	101
PID 4452 wrote to memory of 3284	4452	msedge.exe	100
PID 4452 wrote to memory of 3168	4452	msedge.exe	101
PID 4452 wrote to memory of 4924	4452	msedge.exe	103
PID 4452 wrote to memory of 3876	4452	msedge.exe	112
PID 4452 wrote to memory of 4188	4452	msedge.exe	113
PID 4452 wrote to memory of 3740	4452	msedge.exe	114
PID 4452 wrote to memory of 5040	4452	msedge.exe	116
PID 4452 wrote to memory of 5040	4452	msedge.exe	116
PID 4452 wrote to memory of 5040	4452	msedge.exe	116
PID 4452 wrote to memory of 100	4452	msedge.exe	117
PID 4452 wrote to memory of 100	4452	msedge.exe	117
PID 4452 wrote to memory of 4188	4452	msedge.exe	118
PID 4452 wrote to memory of 4188	4452	msedge.exe	118
PID 4452 wrote to memory of 4264	4452	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://d9lglgm071bc73ehl24g.join-for-preview.com/3aesvr2l9y/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8f47ec188,0x7ff8f47ec194,0x7ff8f47ec1a0
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,11145455579233368694,1642369640579249355,524288 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,7220769475582603366,9865520273294407729,262144 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:2
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,5071865425119845095,18431982581775850133,524288 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,12470323169528656545,7496268183210077385,2097152 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,9321862537327183809,12669109242624469767,2097152 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,9498863896936195180,4400885044985065883,2097152 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,9218575578101659442,2889190991911170285,2097152 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:2
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3656,i,5264666769918619536,90047080096602379,2097152 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5088,i,1875341020435346564,1812072334463240692,2097152 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,10956486631191712044,493519125050021198,524288 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,17227251635381773018,6924188078676803426,524288 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,17097553201659291107,15667671866154242974,524288 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,17097553201659291107,15667671866154242974,524288 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,11841093486256503921,9140672508488294403,524288 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,15993788611958086523,14586248810161989563,524288 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,3796976189100150535,16023942471672595854,524288 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4288,i,15565063394251312255,5422983329895528813,2097152 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,13181696068270593638,17541032171638171636,524288 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,2924565710300352913,9944713672764667382,524288 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6192,i,10619239074452076436,11653011473708214325,262144 --field-trial-handle=2892,i,16650678055334990681,10142705215084145896,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 94a252fd674ca0210dee04315207484b1ec97d23f533e6526355ed9d33d7f132
MD5 c2c58b764e6928bd97f7158efba30208
SHA1 8768fc593b966c5bba8c8031f76b00611c90c681
SHA512 3b23741f06ca9d77f5be4f5cb7285e8bc0ecc6b073c6d0655bc14f998d64d4395ecd5edde4dfb619e456c14c89af500df19043ec7de98059b04b4fce186ccb59
TLSH
T1EA710A303642C8ADE343C131B8D286F37033ADEAF82B5E3000989E7529A5F228C1D6DD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 672badcbd22586dbe921ed8834d941482a6ccf6b4a68ce65f2ad07cf336c5c5d
MD5 19fc92b212f65dfd5f934fe5b717bde2
SHA1 0842771ae69fc4e2da9009fa09188ce7327b48ae
SHA512 3f0d4e17197cab7037f3e0e20c496ec82739768423fc93c78b3076782bc38bdefe849a1cfa324cbd45a23e7da21e90edfdedc97b1dd93b331fb1360f94c87f8c
TLSH
T16841A9E6C3E4866D88221AF09A546E3BCE1D1909432D3D1AC9D4FF5FE3E2031D105B9E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 53b05feed415431a097bd19d50d0a23943bfab739a14e1063f90d220d0dcda32
MD5 4dfaa8c2dd530766de878c186339772f
SHA1 b1fb9960cc03f6775d314e42b44eb77e8b1bceeb
SHA512 5a4e1a8b9a7e21f35d67b1813816491e9ee80626daa4e4b299c0584fcf0c6248c1f758553f0b2fc46bcebed58664e945b31cd62c9e2d17028764d6d32ca07bdf
SSDEEP 192:sxZvRTyM/jK1Ml8MkS/f3sszxIdp7oHW6+WNGYIkyRQIgrJ:sxZvVMS/f3ssz60HbGA9
TLSH
T17C42D6166B345977CCDBD209FA557F53D6F91472E2900E44A9FCDA0C04E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6622c70772f81bbc1be8889952c47ea9915e9c064e7121094159708019dde75b
MD5 225c017d61cbb3407ce9fb7eb51dae72
SHA1 62afb2fc2fee073ab45f5efde6268ead08b3c5dd
SHA512 830cfe8c6a74ef93789c233b16d8e959ca0b82e6663b0780d8ee7e1d85eb5d708cfd88c444e988c731f959bb74aff171b51b424158c0bb4b7ce370e708813717
SSDEEP 192:sxZvRTyM/jK1Ml8UQ1kS/f3s7lxIdp1kHW6+WNGYI+pJQIg5kJ:sxZvVq+S/f3s7l6KHbGNC
TLSH
T1B252D616AA349977CCDBD209FA45BF53D6F50472E2900E44A9FCDA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 61c01aeab882af1964a0c89f49d35c4a53489b32800557616b4c3f3834116445
MD5 944f7770fa9861c5d4283e187d7e8321
SHA1 f541b312dfce3b2e4e6ca73c63fd64f57b474bdf
SHA512 fffe8a915b9f5cb241de567e4e3c57c3ba8f873cf79eca29288ccd749443702e04b88a5e49228dd1ac46d7a780b94e25af81d6825ece4e7ad05a6ee0b51f39af
SSDEEP 768:+gsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9proJ3g:+gsqxXlWvJD6Tu1ja54LAs9CJw
TLSH
T1C1D21B3B694CCB7D4F840E5DEC2A6FD76ED801CBA6988D5447FA884C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d663701bff2440adfb242d9782b071f6da4ff823afaea4087ef4d969e1867a00
MD5 fc55da0f587e2371dc9d28d2ee3b576b
SHA1 a86bb4bf823ae7da27586ae892c01fafb9cc996f
SHA512 180e3f8ba16d78bd3cd2b78bcebec9a146ce3b6b66bcf427fabf3e8bd86dd5747056863c2cc51515021d6ab71460c3f564bc301f43c8e29a00ca49cfdc0c01b4
SSDEEP 96:KYbaKYIKRktgESKK+Ea7lCk+KqLCe+mckDO0f6KQK/6u6ucKnq/:ExV9/7P0
TLSH
T153C1F11A31760A1339BD3988B6AAC6365F4136733018B46F7FB840614E6BE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d070cb3bb1a0cd4afd52065794556d12b464a17ddbae673787bb5e6bd8101529
MD5 d9f970b9cd216085dc0f0e06ae5b92b9
SHA1 3d9c0de3fd63602ac7ea0f59d7464ffd73730a6e
SHA512 486df7e1f890ca259e3a336fb6efda2ca680331e6bbdcbfb0228b90ec9317c4307eefe8d9e51551cac8c56f98ed1e665f0a3c1b64f532aa44f00cc14f3551b6b
SSDEEP 384:FZcIhsN99TbCh3VRN5dc5sJr8HWOObjI9G6w7ql:9h/lH5Cmh8HW29Mk
TLSH
T109927D32AC345C769AE3A916F48B35175EF49177EBC92B84A1EDEB0C01DA5BC4306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a6ac6fdb8f7732534cb9922259d737b5c60a7975b059fc76fee0ac8afbc4e17b
MD5 9e7f98ae98e1a501a6ab022062114c94
SHA1 74b8a5083cae1682d0a33a89f5c4c855de890dd4
SHA512 f78c6b8ca87e2727186177fe83048e874ce03b6172809ccc34bafdfc4e48d1bd7994d385b91e738e6b7c90e19f0b372041f6fb6d2fb2d00e4a7fe4b58a8daee2
SSDEEP 384:/qZcIGzsN9sTbCL3VRN5dc5sJrrHWOObjI9G6w7ql:A28lH5CmhrHW29Mk
TLSH
T13F928D36AC344C779AE3A916F48B35174EF4917BE7C96B84E1EDEB0C01DA5BC0306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2f8a52fb4104fa61fa7b833ac4efa98590e76074b160724f40a22667d125dcbc
MD5 80ef6a4bb940c842bd383b444fdbf372
SHA1 611b51f3cf51f3817b5fda341db3fb553b48f586
SHA512 5f169c4372ba61cff6538541c54e4de7e6604c37ce728e63f17007cf07c7a24853f18eda870eb68a7db79cf0a023bf3ceec3807de4e603774ac25ccb1548a1e4
SSDEEP 384:DZcIhsN9sTbCk3VRN5dc5sJr8HWOObjI9G6w7ql:bhjlH5Cmh8HW29Mk
TLSH
T115927D316C344C769AE3E916F48B35175EF4917BEBC92B84A1FDEB0C01DA5BC4306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cdf8a8f7163a63b99d629924f80589617ba72acbad4f1889bd5091044b8e02f4
MD5 587eb2569e2924b7f3a10072e9a3a40d
SHA1 7c9058f4c0dea3552608b2292e8407c52a7769a7
SHA512 b45d4d334a2f92fe7fb8a1b6d3111d501954605e598fd1de4bc969144c533fce559f60d7427917194a2cbf23c73d20f236bc36366c9b4ea9a2517a9fbc482076
SSDEEP 192:hJON46JkRgQmiUyZBF+RNW+Fd102o1U2tSJriqVcHTqQWU6:zON46Ug6F+RN5dc5sJrsHWU6
TLSH
T155120A366C385C7B5EE36846F48731135EA49167EE8A7F80E1ED6F0C01DB6AC130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a7994d79ca6c5b0fbb339667c3f71a3a30917fcc39059b7f88c49314e44ec03d
MD5 a6faecb22a6a84cb7969de40a9b89b8b
SHA1 bed7b9b06bb4e2771ada9c941f348a1df9a6be0e
SHA512 4c73571fa062ea36188e0e2171bc55995b6ac89795182c8717881decb2cf43733406b75e842637bd5518c5f1dfcc70475aea80248dc0665cd4f7d92d1b808f6a
SSDEEP 192:tONnm6JkRtQmiUyjBW+RNW+Fd102owh3HnRJ7U6:tONm6UrOW+RN5dcQHz7U6
TLSH
T14702C735AD382CBB8EF26D0AB58B27175FA4217BF9962B84D6E81F0C01D765C1347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7540b211426790ca9772c05c3ccf142c47b1a377ed56e738868bbd17e330bdd7
MD5 f3c77b7a2b673c101b4a963dff1bb627
SHA1 9cff8a4e93a9a75836c320fffe890fbb61e3875c
SHA512 da0c85c7202d4f15886193babf7381a9afa4afbcd766a22bb29aa99774d6d07705410268c7aa02b7dffda4b1cb1f9cb833c01dcfcb1f7de9e498b67ae7bc1a71
TLSH
T17B41095CBAEA0148B3B77F569BF6A46D447BBC772E0A949E10110D4F0666A40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download