f998290721106926d4c17adc59286589809707800e5a724ddd98423368adb27a

Resubmissions

31/07/2026, 03:48

260731-ec5anacb98

31/07/2026, 03:45

260731-ea8kastbrf6

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 31KB
Sample260731-ea8kastbrf
SHA256 f998290721106926d4c17adc59286589809707800e5a724ddd98423368adb27a
MD5 e5b2266e6277b3c049be5b91878ee214
SHA1 748868f4152248945f7b7f0efdfaaa93a8bbfd3a
SHA512 59a620b13944b355992fdf9109b266ee1864ccc96ff7e957d78b5faabac27fd8da0588ca05f62ec4a2c7fa4345b8cc48b83d56a1924a440f71bb5dc7cdf7df64
SSDEEP 384:GNoFX7BFOSsCJjsBKv7FYYYoYNYUYkYcYhYR2YEYNJClSvLroWNT2ptedVakGKbn:mo9BWNT2pMS/KbGLkPk11H9N0V2o
TLSH
T1F2E21D2491F8A037408782C62A656B5B3EC2E58BCB5B520076FD97E86FE7C87DC2351D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	discord.com
10	discord.com
130	discord.com
132	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
648	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299431772059919"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{982976DB-DC45-425C-8C45-62A50757991D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{4C7E2079-85A0-4C0B-9C55-C61A1FAC9AEA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 5908	4744	msedge.exe	85
PID 4744 wrote to memory of 2616	4744	msedge.exe	86
PID 4744 wrote to memory of 648	4744	msedge.exe	88
PID 4744 wrote to memory of 2616	4744	msedge.exe	86
PID 4744 wrote to memory of 2616	4744	msedge.exe	86
PID 4744 wrote to memory of 3580	4744	msedge.exe	89
PID 4744 wrote to memory of 3580	4744	msedge.exe	89
PID 4744 wrote to memory of 5484	4744	msedge.exe	90
PID 4744 wrote to memory of 5484	4744	msedge.exe	90
PID 4744 wrote to memory of 5484	4744	msedge.exe	90
PID 4744 wrote to memory of 6108	4744	msedge.exe	91
PID 4744 wrote to memory of 6108	4744	msedge.exe	91
PID 4744 wrote to memory of 6108	4744	msedge.exe	91
PID 4744 wrote to memory of 1088	4744	msedge.exe	92
PID 4744 wrote to memory of 1088	4744	msedge.exe	92
PID 4744 wrote to memory of 1088	4744	msedge.exe	92
PID 4744 wrote to memory of 5200	4744	msedge.exe	100
PID 4744 wrote to memory of 1764	4744	msedge.exe	101
PID 4744 wrote to memory of 1764	4744	msedge.exe	101
PID 4744 wrote to memory of 5764	4744	msedge.exe	106
PID 4744 wrote to memory of 4896	4744	msedge.exe	107
PID 4744 wrote to memory of 2940	4744	msedge.exe	108
PID 4744 wrote to memory of 4528	4744	msedge.exe	110
PID 4744 wrote to memory of 4528	4744	msedge.exe	110
PID 4744 wrote to memory of 6124	4744	msedge.exe	111
PID 4744 wrote to memory of 6124	4744	msedge.exe	111
PID 4744 wrote to memory of 1888	4744	msedge.exe	113
PID 4744 wrote to memory of 4772	4744	msedge.exe	116
PID 4744 wrote to memory of 4772	4744	msedge.exe	116
PID 4744 wrote to memory of 5528	4744	msedge.exe	118
PID 4744 wrote to memory of 5528	4744	msedge.exe	118
PID 4744 wrote to memory of 1856	4744	msedge.exe	129
PID 4744 wrote to memory of 2276	4744	msedge.exe	130
PID 4744 wrote to memory of 2276	4744	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdd6dfc188,0x7ffdd6dfc194,0x7ffdd6dfc1a0
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,17281665932953743298,12191671037672841754,262144 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,1869666275998790909,2261162076910065176,524288 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,894944075698278557,2789592374859084161,524288 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,14304010624636099688,1688101385577699347,2097152 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,8915659253846606829,7029383406484223007,2097152 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4900,i,17641275142681105734,17359217480729612179,2097152 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,15130631012611179924,3076984455549005116,524288 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,6948755165730790070,13925147664815420053,524288 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,16602322407894623878,11175980960571077898,524288 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,2316227390501334704,11010304213262698980,524288 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,3444899583816784206,16506608130560471676,524288 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,125174150541960869,9098035247198383608,524288 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,135724422302534675,3067282172911041294,524288 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,17916633760510334386,14368456527021591715,524288 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,17916633760510334386,14368456527021591715,524288 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,14287361356884497188,3221378784431318052,524288 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,9829222766059017784,13860566505832658483,524288 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5848,i,16421671096056382538,1858715183662460077,262144 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,16821484266806989986,1520294862695634745,524288 --field-trial-handle=2264,i,6173600505196439550,7813937494945304869,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:2276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 abfaaeeda1f52c0b4ed255df8e8ecf8c9901282ff7df57ec4436eb430b834dad
MD5 ee0763510ae679c3a2638e19de87a1cc
SHA1 a3336418bfb637902425423b138231178917da77
SHA512 cefea22a4ed9435a01c64a8eb63c6499ff39457c3d7af7999b54a74c3ce214bd69dda4865cb2676bda00fb52539c6499aedb88f3203cf9c761502c5393636d67
SSDEEP 192:mjqkn5555555dddddddddOllll++GG555555lAZh:mjqkn5555555dddddddddOllll++GG5a
TLSH
T141F1504787D9CA9A9F1520DA8EA063AC10743B0DEBDDD608134CDDFD308E4DBF5A9A94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f220c24a538e170241a6b6dbc3a31b512154306a40154aaddbde80a49e5d98bb
MD5 f94157a896ea73035097c2732251129a
SHA1 846fcc707038ce7a2cde99bb897e8c4e4fa4a243
SHA512 e683d6f62f47b2aec5cab29a3787e88a07eb4bda489abe0994a3df3841d49edecb74303375d47cb034309d2ac522549744e0f6b6ceec9ba5935c0da51afa4c26
TLSH
T198E02BA6C821FC2718FD172960495656E70013573E40895F3A3C91098FB062685C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 793922bd756ada2f1d9214969ff31c359c3ed1e561eae391346c131073b6f250
MD5 7bb143787689b13319eecf88225f1796
SHA1 4bb2fddb929ad726e0974f81978301fc744993e5
SHA512 fe6cf9c513155ce09171c3fadba4687696159e7bee44d8bc6b35d4e09a2d13c932f52abd7cd6dc5e3ce5f65677632ea7320e443b3b7275ce32abc46471514a45
TLSH
T1D081E63225524DFAD3B0037A89D01926F432C6EAFB175FCF2140A4372931723B26BB29
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5936d5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5936d5.TMP
Size 3KB
SHA256 f098757c9874051ab333ecc3c27a77611e4eb20dff4d3aca967010667f523be5
MD5 01db8982a1c419267109d4d1327cd06e
SHA1 8bda5af211d879d90648aa3ea81b17e9923fe964
SHA512 de4029be872b5bcaaa2d02a00141cd5a8ae4aac7468e7c2586c1ca0a2a47d4c6b97f49d0e1a3e8de14d1b5150dd1c387bde46f643586f74a0882e687aed780db
TLSH
T1F981D63225524DF9D3B1037A95D01A26F432C6E9FB175FCF2140A0372931723B25B719
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9ffdaf0aa127a67392f2b000976171f6945651f32a4198f44b765333e9a2462f
MD5 c94c029f2ff26b737e20d1333435af68
SHA1 ea1003e7d053f9006f4606eec43b6486f412b7b6
SHA512 67f1f1f10ad251b87a6ed6d0317a6b8aea2258848fa489e73f023a858ad53230dd1d0d79e618f315194dbdfdd2b92807ebe2da8d61fd4fbb04030cff77dfc867
SSDEEP 48:YALlgyDPNjOgpIg6gNhqhRETafo7gmgj6As8udzs2zEsrZIEsUZMsR+sy7si2sIO:D15OPFA0bGaaij6HhzHZI4ZNIbiQeGwQ
TLSH
T10281AEF6C2E8477D855156F0AB257D1BCE2D055A422C3C6A89F8AF1F63E2470D10269F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 64ccaaf998134f1c029038538f0be501919eb975a38eea047ff999b65b876d07
MD5 9c5bdd7dc48abf919c260af0c1951a73
SHA1 6fd0d6812a26e387bd5f055b583101b46ded036b
SHA512 2c926130f47b74e018fbd684bf1558f2addf00194d30822f54c8b007afe94c0eec4cef8998cb3688da8ca0531db8bef1f9ac32937604843e0fbe1c61d29bf60b
SSDEEP 192:sxZMRtyMqZjK1Ml8MkJ/fBssYvaZd8zodpHuHW6+WNGYvIC+lZlIgjHJ:sxZMqMJ/fBssYvazfOHbGrbpjp
TLSH
T16B62D8066A38597BCCDBD219F6457F53D6F81563A2904E44AAFCCB0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6b0f14559d955090da217691a8fb039903d25b8e82e014a9edafc783abe34fef
MD5 34254e7b8589cc77634b00bd35def6c7
SHA1 8f60f8ec8f0004db1991dda9271baeab1ca37bfc
SHA512 d53d9aa723974a50e66b51eae4e3e8648068d0867ea2de5d34dbb56ae4d91b413e59fd8fe2290f445a557a86cc30280bddc2eea6551b080244cf7130789ff29e
SSDEEP 192:sxZMRtyMqZjK1Ml8UQWkJ/fBs1DZdqzodpHuHW6+WNGYvR/blZlIg5PHJ:sxZMCq9J/fBs1DzROHbGEbp9p
TLSH
T19862E81A6A34997B8CDBD21AF6457F53D6F91173E2905E44A9FC8A0C04E7BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 544460d38477368b049eda5c7141a1c680bd1f32b19f114cf923f4301bd8b488
MD5 2b1cb384077e5a9e95b69ec1de0299d1
SHA1 c74e24d1f1b0a9a55bd6ba6ccfb18a5c177c95e6
SHA512 f37b97da34f1ce581ba6ac59372e258ecb78b35095c4176126eb7571784b55f1bf745f52bedfce83515602fdbfa7327988f37816d384dff35d483d7113f4f7e5
SSDEEP 192:sxZMRtyMqZjK1Ml8MkJ/fBs1DZdqzodpHuHW6+WNGYvR/2lZlIg5PHJ:sxZMCMJ/fBs1DzROHbGlbp9p
TLSH
T1CF62E9166A34997B8CDBD219F6457F53D6F91173E2905E44AAFC8A0C04E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 19395057181efaf09a053d4662d7659250b6da09e8a6090ec30ec3f354f4748e
MD5 c155054f9e8159f3e226c54f08693656
SHA1 88838e33ce346005225fd6b3a160afaab97b1bcc
SHA512 eff85b7dbb58b8e7873ac4d2a60dab52473fe4691065d4bbe0d11e39501e5110b1a783d80a883ac2370deaa06452f9773993e4faa7324f41032e5fc70e5b3926
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9JyzGi0wMBwtO6uBmsRCiN0C5WeTI0eY4HU9IM640:0LppY93PBZJPtN53t70
TLSH
T120B27C5A703F0212397E2948B39696364F4235A37058E4AF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ae88ae3e48d70544427dfbc62562cecaae873279c3275df7c6b387b83ef5db02
MD5 116d1899b9f4fb763c5bfddbba21743d
SHA1 302184bc1e80738eef5c239638a729d4fb6939ef
SHA512 92102fb5201680955c64273bd5e5951e23953cb461239a33e2884f332a71ace61314e62332e9dab691b0c0408c6f71f834161bec103cb42e7ca65796603fbe0e
SSDEEP 384:npHiF9CcmyWCs3sNE8TUNTUlIm2QckCr9PRLphiftGP/sxXL5sAe4KV8p0+Hrtyf:pCFccps39wgbkUJloGP/sx1sAI8p0oK
TLSH
T1CDC25A32E868CDBBECD38B99B74A3903DEE05267858C5AE4DADC1E4D00971ED530BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e845208586b46d52c2fc134f3876fb85b4f2764efd31b44dd35b924b6f5a6587
MD5 45225743a6da7b8399d29b8e0be29d5f
SHA1 ba8feba00f3e83e58d38aadeae2c218c8d940369
SHA512 ec517fed675eb770078f81cb32cc11c90fe4aacf9a0f098164bc4be15b9781678d7a0ce153576ba0497e510fc8622518ec1d6cc958239fe5ae3ffdfc48402b54
SSDEEP 384:npviF9CcmyWCs3sN48TUNTUlI42QckCrVNKphiftGP/sxXLysAe4KV8p0+Hrty/+:p6Fccps3twgbkukoGP/sxusAI8p0oj
TLSH
T168C24A32E868DDBBECD38B99B74A3903DEE05163858C5AE4DADC1E4D00971ED530BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5e44e6e02911d5354dc34baefe60e044a1a16ab3bcafa78e636817cf32664929
MD5 f196a20a24b0f2294bfc7235aed7c53d
SHA1 03e6d69fc5aa408c42724613d8588b05fd91437d
SHA512 b8cb8fb7cb95bb67eb7a075caa5930a74bd3f9b8fd812f58d389b4eae044bacc051d7305638b14716d63be1ada90348f9222e86ac4a8ffae3ebe2b05f89c93e8
SSDEEP 384:nFiFiZcIOA3sN48TUNTUlI4mQckCreNKphiftGP/sxXL+sAOObjI9G6w7Nty/7Iz:MFQb3twgBkXkoGP/sxKsA29Mh
TLSH
T1A2D25B36E864CABBEDE78B96B78A3903EEF05163D58C5AD8D5DC5E0D00971AC0307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 01a97570d0c7e8715f6091aafd55b562f73b92eb0defde2762e90ea9ad2c7b9c
MD5 6c9e1160a71ab65fe64e5f36d48d958e
SHA1 2d517ac54a50312e0aa6f3e0436bf97ef249901a
SHA512 35a7b41674ca9f7eb741016cd7b34e6c6aa3234256667958aaae363c6cd1c6728622d8ecb1b2aea322f6a1ec2ee6e836a24ae11a2afe27afd9c8eb170883667c
SSDEEP 384:npgiF9CcmyWCs3sNF8TUNTUlIm2QckCr9lmKphiftGP/sc8pse4KV8p0+Hrty/7j:p7Fccps3owgbkUwkoGP/sctI8p0oK
TLSH
T18EB24B36EC68DDBBEDE34F99B74E3A03DEE05167859C59E4CAD81E0D00931AC170B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e64bae0bd676781836ed6668e08649aee38f77f67c992f5ef42789bc22d09207
MD5 138c32d5b379a62b62df85792bea03a3
SHA1 204b165468b8fb68bcc72d4734e3269f6e3da87d
SHA512 6b66833b6fa0de73a39d31d2178666a7c3cbeaf96d2f25d540540ea114304b5df7f5b273b021cce2d89b36f2bd8a90d22a598d9dfc457d99ed5fd71a90f78340
SSDEEP 384:nBiF9CcmyWCs3sN48TUNTUlI42QckCrVNKphiftGP/sxXLysAe4KV8p0+Hrty/7K:oFccps3twgbkukoGP/sxusAI8p0oj
TLSH
T165C24A32E868DDBBECD38B99B74A3903DEE05163858C5AE4DADC1E4D00971ED530BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c73c2305ca78b0bd83497937188173b718809a39a9bafbd1e9c4fb7944bc6fea
MD5 e1b673630843b07a9fff9544cdab8f0d
SHA1 468209d1f40802c11a7f91a1f7bb41be4fe2d842
SHA512 eb6e22b605ab49ea28f3fe2530f536645faf75e2b70518bfba08b96926d174f584ca585c824484d4feb8764de13dd22e4d6e6f6f73c0106f888431ab2f5ed7cd
SSDEEP 384:nBiFiZcI23sN48TUNTUlI4mQckCrVNKphiftGP/sxXLysAOObjI9G6w7Nty/7IgG:oFQ23twgBkukoGP/sxusA29Mh
TLSH
T1A6D25A32E864CABBADE78B96B38A3A03EEF04163D58C5AD8D5D85E0D00971AC0307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 720b59d57c5166297e194b54251a7946c840634de090214933fa32f73528743d
MD5 d654889498fc74485253d5e497e0b1c8
SHA1 a3037ce8ef14a6ace97330dcaf2b07f25a5c7ae9
SHA512 35f004bd66e81523f62fe6fc66ff10b7981e764ad6245e0e172aa4581373c21d5c5c550b907f6dd57a7eeacc31e388895b7aef8a7326daeceeaf14fcd48c179a
TLSH
T1F6411A58A6F91148B3B76F5A9BF7A86D487BBC772F0AD45E10010E4E0672A00C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download